{ "generated_at": "2026-09-21T05:30:02+00:00", "source": "pqcrypta-proxy curated database + live observations", "total": 3644, "of": 3644, "tiers": { "curated": 179, "observed": 3465 }, "query": { "q": "", "class": "all", "tier": "all", "sort": "default" }, "license": "CC BY 4.0", "docs": "https://pqcrypta.com/ja4/", "entries": [ { "hash": "01319090aea981dde6fc8d6ae71ead54", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "vpnkit", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "028563cffc7a3a2e32090aee0294d636", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,eclipse,STS", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0411bbb5ff27ad46e1874a7a8beedacb", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "093081b45872912be9a1f2a8163fe041", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0ef9ca1c10d3f186f5786e1ef3461a46", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "bitgo,ShapeShift", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0fe51fa93812c2ebb50a655222a57bf2", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LINE Messaging", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "106ecbd3d14b4dc6e413494263720afe", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "node.js,Postman,WhatsApp", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "107144b88827da5da9ed42d8776ccdc5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "116ffc8889873efad60457cd55eaf543", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Spark", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "187dfde7edc8ceddccd3deeccc21daeb", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse,java,studio,STS", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "190dfb280fe3b541acc6a2e5f00690e6", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many programs,Quip,Spotify,Dropbox,GitHub Desktop,etc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "193349d34561d1d5d1a270172eb2d97e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LogMeIn Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "1fbe5382f9d8430fe921df747c46d95f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "FieldServiceApp,socialstudio", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2080bf56cb87e64303e27fcd781e7efd", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "225a24b45f0f1adbc2e245d4624c6e08", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2d3854d1cbcdceece83eabd85bdcc056", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Tableau", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2db6873021f2a95daa7de0d93a1d1bf2", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,studio,eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2e094913d88f0ad8dc69447cb7d2ce65", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LINE Messaging", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "32e4b8812cda0c0d50783b438492a769", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "curl 8.x (observed 2026-07-31)", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "38cbe70b308f42da7c9980c0e1c89656", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "p4v,owncloud", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3959d0a1344896e9fb5c0564ca0a2956", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LeagueClientUx", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "39cf5b7a13a764494de562add874f016", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Steam OSX", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3afe1fb5976d0999abe833b14b7d6485", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3b844830bfbb12eb5d2f8dc281d349a9", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3e860202fc555b939e83e7a7ab518c38", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4056657a50a8a4e5cfac40ba48becfa2", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "424008725394c634a4616b8b1f2828a5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Charles,java,eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "488b6b601cb141b062d4da7f524b4b22", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many programs,Python,PHP,Git,dotnet,Adobe", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4990c9da08f44a01ecd7ddc3837caf25", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "49a341a21f4fd4ac63b027ff2b1a331f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Skype", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "49a6cf42956937669a01438f26e7c609", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AIM", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "49de9b1c7e60bd3b8e1d4f7a49ba362e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "nwjs,Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4fcd1770545298cc119865aeba81daba", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Deezer", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "51a7ad14509fd614c7bb3a50c4982b8c", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "550628650380ff418de25d3d890e836e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5507277945374659a5b4572e1b6d9b9f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "apple.geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "561145462cfc7de1d6a97e93d3264786", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Airmail 3", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "56ac3a0bef0824c49e4b569941937088", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5af143afdbf58ec11ab3b3d53dd4e5e3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "IDSyncDaemon", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5b270b309ad8c6478586a15dece20a88", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5c1c89f930122bccc7a97d52f73bea2c", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5cfbaea088a6084eefed5c5e8c3972ec", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "GNU Wget (observed 2026-07-31)", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5d7abe53ae15b4272a34f10431e06bf3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5ee1a653fb824db7182714897fd3b5df", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Citrix Viewer", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5f9b53f0d39dc9d940a3b5568fe5f0bb", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,JavaApplicationStub", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "6003b52942a2e1e1ea72d802d153ec08", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Amazon Music", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "61d50e7771aee7f2f4b89a7200b4d45e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AcroCEF", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "62448833d8230241227c03b7d441e31b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "parsecd,apple.geod,apple.photomoments,photoanalysisd,FreedomProxy", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "641df9d6dbe7fdb74f70c8ad93def8cc", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "node.js", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "6acb250ada693067812c3335705dae79", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "mono-sgen,Syncplicity,Axure RP 8,Amazon Drive", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "77310efe11f1943306ee317cf02150b7", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7c7a68b96d2aab15d678497a12119f4f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "83e04bc58d402f9633983cbf22724b02", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Charles,Google Play Music Desktop Player,Postman,Slack,and other desktop programs", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "84071ea96fc8a60c55fc8a405e214c0f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many desktop apps,Quip,Spotify,GitHub Desktop", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "844166382cc98d98595e6778c470f5d5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Salesforce Files", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "84607748f3887541dd60fe974a042c71", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "wineserver", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "88afa0dea1608e28f50acbad32d7f195", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "88f1fd7a4ad8bf2abd56176f5455424b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "OpenSSL s_client (observed 2026-07-31)", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8bd59c4b7f3193db80fd64318429bcec", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8c5a50f1e833ed581e9cfc690814719a", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse,JavaApplicationStub,idea", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8ce6933b8c12ce931ca238e9420cc5dd", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8e3f1bf87bc652a20de63bfd4952b16a", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AnypointStudio", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "900c1fa84b4ea86537e1d148ee16eae8", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Fuze", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "9811c1bb9f0f6835d5c13a831cca4173", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "node.js", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a585c632a2b49be1256881fb0c16c864", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Tableau", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a5aa6e939e4770e3b8ac38ce414fd0d5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Slack", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a61299f9b501adcf680b9275d79d4ac6", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a7823092705a5e91ce2b7f561b6e5b98", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Qsync Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a9d17f74e55dd53fcf7c234f8a240919", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Covenant Eyes", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a9fead344bf3ac09f62df3cd9b22c268", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ae340571b4fd0755c4a0821b18d8fa93", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Google Earth", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ba40fea2b2638908a3b3b482ac78d729", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "apple.geod,parsecd,apple.photomoments", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "bc0608d33dc64506b42f7f5f87958f37", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "cscan", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "be9f1360cf52dc1f61ae025252f192a3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c048d9f26a79e11ca7276499ef24daf3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "RescueTime,Plantronics Hub", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c2b4710c6888a5d47befe865c8e6fb19", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "ZwiftApp", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c376061f96329e1020865a1dc726927d", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "JavaApplicationStub", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c46941d4de99445aef6b497679474cf4", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c5c11e6105c56fd29cc72c3ac7a2b78b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AT&T Connect", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c882d9444412c00e71b643f3f54145ff", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Creative Cloud", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c9dbeed362a32f9a50a26f4d9b32bbd8", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Messenger,Jumpshare", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ccaa60f6ccc701bde536ef409be3cf63", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "curl no-SNI", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "cd7c06b9459c9cfd4af2dba5696ea930", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Tableau", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "cdec81515ccc75a5aa41eb3db22226e6", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "BlueJeans,CEPHtmlEngine", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d06acbe8ac31e753f40600a9d6717cba", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Inbox OSX", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d1f9f9b224387d2597f02095fcec96d7", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d219efd07cbb8fbe547e6a5335843f0f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "ruby", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d27fb8deca6e3b9739db3fda2b229fe3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Google Drive File Stream", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d732ca39155f38942f90e9fc2b0f97f7", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Maxthon", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d74778f454e2b047e030b291b94dd698", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse,java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "def8761e4bcaaf91d99801a22ac6f6d4", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "df65746370dcabc9b4f370c6e14a8156", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "True Key", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e0224fc1c33658f2d3d963bfb0a76a85", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Viber", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e516ad69a423f8e0407307aa7bfd6344", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Kindle,stack,nextcloud", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e7d46c98b078477c4324031e0d3b22f5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Cisco AnyConnect Secure Mobility Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e846898acc767ebeb2b4388e58a968d4", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "postbox-bin", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "eb149984fc9c44d85ed7f12c90d818be", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Amazon Music,Dreamweaver,Spotify", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ed36017db541879619c399c95e22067d", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Cisco AnyConnect Secure Mobility Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f059212ce3de94b1e8253a7522cb1b44", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Google Photos Backup", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f22bdd57e3a52de86cda40da2d84e83b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,eclipse,Cyberduck", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f28d34ce9e732f644de2350027d74c3f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many programs,Quip,Aura,Spotify,Chatty", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f6fd83a21f9f3c5f9ff7b5c63bbc179d", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Alation Compose", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f753495f2eab5155c61b760c838018f8", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "apple.geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fa030dbcb2e3c7141d3c2803780ee8db", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Battle.net,Dropbox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fa106fe5beec443af7e211ef8902e7e0", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fc5cb0985a5f5e295163cc8ffff8a6e1", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fd10cc8cce9493a966c57249e074755f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "gramblr", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fe048fe8faf797796e278f2b4f1e9c24", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "curl SNI", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ff1040ba1e3d235855ef0d7cd9237fdc", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "002205d0f96c37c5e660b9f041363c11", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "073eede15b2a5a0302d823ecbd5ad15b", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "07b4162d4db57554961824a21c4a0fde", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox,thunderbird", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0a81538cf247c104edb677bdb8902ed5", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0b61c673ee71fe9ee725bd687c455809", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0b6592fd91d4843c823b75e49b43838d", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0e46737668fe75092919ee047a0b5945", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome Helper", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0ffee3ba8e615ad22535e7f771690a28", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "1c15aca4a38bad90f9c40678f6aface9", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "20dd18bdd3209ea718989030a6f93364", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs,Slack,Postman,Spotify,Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "39fa85654105398ee7ef6a3a1c81d685", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome Helper", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3e4e87dda5a3162306609b7e330441d2", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,itunesstored", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3ee4aaac7147ff2b80ada31686db660c", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "node-webkit,Kindle", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "40fd0a5e81ebdcf0ec82a4710a12dec1", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "474e73aea21d1e0910f25c3e6c178535", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4ba7b7022f5f5e1e500bb19199d8b1a4", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome Helper", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4c40bf8baa7c301c5dba8a20bc4119e2", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Dynalist,Postman,Google Chrome,Franz,GOG Galaxy", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5163bc7c08f57077bc652ec370459c2f", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5498cef2cca704eb01cf2041cc1089c1", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome,Slack", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "618ee2509ef52bf0b8216e1564eea909", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "61d0d709fe7ac199ef4b2c52bc8cef75", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox,thunderbird", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "63de2b6188d5694e79b678f585b13264", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,Chatter,FieldServiceApp,socialstudio", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "6cd1b944f5885e2cfbe98a840b75eeb8", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "799135475da362592a4be9199d258726", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7b343af1092863fdd822d6f10645abfb", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,itunesstored", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7b530a25af9016a9d12de5abc54d9e74", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7e72698146290dd68239f788a452e7d8", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8498fe4268764dbf926a38283e9d3d8f", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Franz,Google Chrome,Kiwi,Spotify,nwjs,Slack", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8db4b0f8e9dd8f2fff38ee7c5a1e4496", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "SpotlightNetHelper,Safari", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "94c485bca29d5392be53f2b8cf7f4304", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a312f9162a08eeedf7feb7a13cd7e9bb", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,Spotify,WhatsApp,Skype,iTunes", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a88f1426c4603f2a8cd8bb41e875cb75", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a9aecaa66ad9c6cfe1c361da31768506", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "b03910cc6de801d2fcfa0c3b9f397df4", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "b4f4e6164f938870486578536fc1ffce", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "b8f81673c0e1d29908346f3bab892b9b", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "baaac9b6bf25ad098115c71c59d29e51", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "bc6c386f480ee97b9d9e52d472b772d8", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "bfcc1a3891601edb4f137ab7ab25b840", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c05de18b01a054f2f6900ffe96b3da7a", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c07cb55f88702033a8f52c046d23e0b2", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c36fb08942cf19508c08d96af22d4ffc", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Safari", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ce694315cbb81ce95e6ae4ae8cbafde6", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d4693422c5ce1565377aca25940ad80c", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,CalendarAgent,Go for Gmail", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "da949afd9bd6df820730f8f171584a71", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e4d448cdfe06dc1243c1eb026c74ac9a", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "eeeb5e7485f5e10cbc39db4cfb69b264", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f15797a734d0b4f171a86fd35c9a5e43", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f1c5cf087b959cec31bd6285407f689a", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f58966d34ff9488a83797b55c804724d", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fd6314b03413399e4f23d1524d206692", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t10d640300_13a2a23d501b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "13a2a23d501b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182-49185-49178-49181-49184,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710042, "last_seen": 1788842293, "transport": "t", "ja3_hash": "8f4558f961e7a3cf6353ec38ed7bed7f", "ja3_variant_count": 4, "ja3_variants": [ "8f4558f961e7a3cf6353ec38ed7bed7f", "a62471e0ef89283af324b0b17c4ba2d9", "1e04bd3007c72ce6c4708abaf5c26f86", "1cf8794db2c63b873adec843db18e142" ], "user_agents": [] } }, { "hash": "t10d640300_67f0ca237a44_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "67f0ca237a44", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138-98-97-96-100,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710042, "last_seen": 1788842292, "transport": "t", "ja3_hash": "60539ffbec08c42fcab2660f70ce21ca", "ja3_variant_count": 4, "ja3_variants": [ "60539ffbec08c42fcab2660f70ce21ca", "dda124905371562b72d28ea0e1364241", "a08c2570a9135eb2d9a7f1743196e091", "29f7908a42e8346e0f36114a59093e3f" ], "user_agents": [] } }, { "hash": "t10d640300_a3acda31d846_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "a3acda31d846", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710041, "last_seen": 1788842292, "transport": "t", "ja3_hash": "ddb64773428ea1a717a1db2c4adadc0c", "ja3_variant_count": 4, "ja3_variants": [ "ddb64773428ea1a717a1db2c4adadc0c", "8bd378bc6eb2437401966e9671e51f65", "e8295a33a07fee21d46665a494a86d1c", "84aa4572e2eed72a96b16dfd7540de28" ], "user_agents": [] } }, { "hash": "t10d640300_e31a90cd0803_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "e31a90cd0803", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710044, "last_seen": 1788842294, "transport": "t", "ja3_hash": "fa2ce5a3078abb9c449e8fbb1fe0ea6f", "ja3_variant_count": 4, "ja3_variants": [ "fa2ce5a3078abb9c449e8fbb1fe0ea6f", "24a712a9ef23f5d514e47fffb5596245", "deb61e94362e500c8eefe17a507235dc", "12b636358ea66419c16709def10d17c4" ], "user_agents": [] } }, { "hash": "t10d640300_e7b476f9520b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "e7b476f9520b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710040, "last_seen": 1788842291, "transport": "t", "ja3_hash": "c2d96b3eccae65ca252907adb1ad4124", "ja3_variant_count": 4, "ja3_variants": [ "c2d96b3eccae65ca252907adb1ad4124", "7064e70dc94279db549fc80a14f5679a", "c5f9dae86f8168fb85a1d40a368e9e37", "64f50b8bf471f53daa286f30e82ad40a" ], "user_agents": [] } }, { "hash": "t10d640300_f559eb9565fd_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "f559eb9565fd", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710042, "last_seen": 1788842293, "transport": "t", "ja3_hash": "e53f411daff3deced39ac87d3ef6e65a", "ja3_variant_count": 4, "ja3_variants": [ "e53f411daff3deced39ac87d3ef6e65a", "55559d24913a32b13e6559b0bc63295e", "ac618ad4c83155431a3876dd4ada6d79", "4bc17aa9833ab551da3d2017dc0ecbf9" ], "user_agents": [] } }, { "hash": "t11d640300_13a2a23d501b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "13a2a23d501b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182-49185-49178-49181-49184,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710046, "last_seen": 1788842296, "transport": "t", "ja3_hash": "8de9c7c43a53600a7b5e20dc77459331", "ja3_variant_count": 4, "ja3_variants": [ "8de9c7c43a53600a7b5e20dc77459331", "7281eb6b5b7a144d4aa9a87a2c63c45d", "66295e0e528e74245f9f6ceb9de8e87d", "bcac1c6a33bb1c7da989a42a27894e9b" ], "user_agents": [] } }, { "hash": "t11d640300_67f0ca237a44_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "67f0ca237a44", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138-98-97-96-100,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710045, "last_seen": 1788842295, "transport": "t", "ja3_hash": "77d8246c50a0c1f2d98525dcea42ef29", "ja3_variant_count": 4, "ja3_variants": [ "77d8246c50a0c1f2d98525dcea42ef29", "40af735e9c434f039760391a794d3aa2", "8c86fd6889132179662580ad6e8780a2", "eed78583a98688831893f81d05e27c82" ], "user_agents": [] } }, { "hash": "t11d640300_a3acda31d846_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "a3acda31d846", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710045, "last_seen": 1788842295, "transport": "t", "ja3_hash": "520978d10abe048e7109ae4ae07c6c7b", "ja3_variant_count": 4, "ja3_variants": [ "520978d10abe048e7109ae4ae07c6c7b", "cecf4f0a803718be652f9fa623105a0a", "0bf272196481d0da5f4730cd63f1fa57", "c6110e78375b92ff48e1b450c22a3c88" ], "user_agents": [] } }, { "hash": "t11d640300_e31a90cd0803_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "e31a90cd0803", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710046, "last_seen": 1788842295, "transport": "t", "ja3_hash": "fdb52e11d68966be00fcb1347073e39a", "ja3_variant_count": 4, "ja3_variants": [ "fdb52e11d68966be00fcb1347073e39a", "b3d1bc7b276289d815dd513730dc61eb", "c3f81d67d0e52f81c773e0f62ee1ac4b", "f625e4df6b7d68d7aacf37641c956175" ], "user_agents": [] } }, { "hash": "t11d640300_e7b476f9520b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "e7b476f9520b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710044, "last_seen": 1788842295, "transport": "t", "ja3_hash": "dc3c9110c7a2cd3a24fa387147dd1779", "ja3_variant_count": 4, "ja3_variants": [ "dc3c9110c7a2cd3a24fa387147dd1779", "499a39d0686735e11bf4641098545dc4", "f0e9c8866d60282351c447d53ad69a0c", "416dacce2e6f8ee14248d993ed769de9" ], "user_agents": [] } }, { "hash": "t11d640300_f559eb9565fd_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "f559eb9565fd", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710045, "last_seen": 1788842296, "transport": "t", "ja3_hash": "627e21d18e5721958c0c7ae774b71231", "ja3_variant_count": 4, "ja3_variants": [ "627e21d18e5721958c0c7ae774b71231", "d4e98f040b64040e4249d6870af72345", "d8b071c520af654d2540d1ec71dbc680", "cc69b70d7a5c8f329b8894480122e802" ], "user_agents": [] } }, { "hash": "t12d190600_9c2f387b437f_82b0993b6ad8", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d190600", "b": "9c2f387b437f", "c": "82b0993b6ad8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 6, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_13a2a23d501b_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "13a2a23d501b", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_67f0ca237a44_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "67f0ca237a44", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_a3acda31d846_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "a3acda31d846", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_e31a90cd0803_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "e31a90cd0803", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_e7b476f9520b_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "e7b476f9520b", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_f559eb9565fd_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "f559eb9565fd", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "q13d0311h3_55b375c5d22e_e3b8e4ce5af0", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "quic-go \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "e3b8e4ce5af0", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-5-10-11-13-65281-16-18-43-51-57,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787535370, "last_seen": 1789748788, "transport": "q", "ja3_hash": "3e9680842aa1ac1f48edc74e779ebc97", "ja3_variant_count": 1, "ja3_variants": [ "3e9680842aa1ac1f48edc74e779ebc97" ], "user_agents": { "quic-go-HTTP/3": 56 }, "ua_disagreement": false } }, { "hash": "q13d0411h3_16476d049b0b_8d0f06507a4e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0411h3", "b": "16476d049b0b", "c": "8d0f06507a4e", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865-255,0-10-16-22-23-49-13-43-45-51-57,4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788989711, "last_seen": 1788989730, "transport": "q", "ja3_hash": "d77d6df709f1b67a8e4c5c97a28518c5", "ja3_variant_count": 1, "ja3_variants": [ "d77d6df709f1b67a8e4c5c97a28518c5" ], "user_agents": { "curl/8.18.0-DEV": 2 }, "ua_disagreement": false } }, { "hash": "t12d080700_0df93f53a2f9_b871c60bacbc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (b871c60bacbc) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d080700", "b": "0df93f53a2f9", "c": "b871c60bacbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 8, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49200-49199-49192-49191-49196-49195-49188-49187,0-10-11-13-35-23-65281,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789575268, "last_seen": 1789578545, "transport": "t", "ja3_hash": "5b0ffbfa2ef37b8d4e4953c76f689d77", "ja3_variant_count": 1, "ja3_variants": [ "5b0ffbfa2ef37b8d4e4953c76f689d77" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d150400_8daaf6152771_93b9751e4c3e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "93b9751e4c3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789130286, "last_seen": 1789130286, "transport": "t", "ja3_hash": "e921bfee618b8399a0f03c6bfc1842f8", "ja3_variant_count": 1, "ja3_variants": [ "e921bfee618b8399a0f03c6bfc1842f8" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_002c0579dc72", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "002c0579dc72", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-65281-45-35-18-27-0-65037-23-17613-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789699353, "last_seen": 1789699353, "transport": "t", "ja3_hash": "92c244e203cd171a7bb1ab8e0ff617f2", "ja3_variant_count": 1, "ja3_variants": [ "92c244e203cd171a7bb1ab8e0ff617f2" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t12d180700_4b22cbed5bed_b871c60bacbc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (b871c60bacbc) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d180700", "b": "4b22cbed5bed", "c": "b871c60bacbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1788460412, "last_seen": 1789534889, "transport": "t", "ja3_hash": "6a5d235ee78c6aede6a61448b4e9ff1e", "ja3_variant_count": 1, "ja3_variants": [ "6a5d235ee78c6aede6a61448b4e9ff1e" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d180800_5d04281c6031_021da7cd3809", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Claude-User \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d180800", "b": "5d04281c6031", "c": "021da7cd3809", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49199-49195-49200-49196-49191-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788489060, "last_seen": 1789827341, "transport": "t", "ja3_hash": "e422b48cc39491764bf12f66fdef4771", "ja3_variant_count": 1, "ja3_variants": [ "e422b48cc39491764bf12f66fdef4771" ], "user_agents": { "Claude-User (claude-code/2.1.278; +https://support.anthropic.com/)": 2, "Claude-User (claude-code/2.1.255; +https://support.anthropic.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t12d200700_22c523c4c553_b871c60bacbc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (b871c60bacbc) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d200700", "b": "22c523c4c553", "c": "b871c60bacbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 20, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 75, "first_seen": 1787451579, "last_seen": 1789900359, "transport": "t", "ja3_hash": "095a9cdf6fceacc9c38736015b7d1ec4", "ja3_variant_count": 1, "ja3_variants": [ "095a9cdf6fceacc9c38736015b7d1ec4" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d210700_76e208dd3e22_b871c60bacbc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d210700", "b": "76e208dd3e22", "c": "b871c60bacbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 21, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 142, "first_seen": 1787464648, "last_seen": 1789751260, "transport": "t", "ja3_hash": "3b5074b1b5d032e5620f69f9f700ff0e", "ja3_variant_count": 1, "ja3_variants": [ "3b5074b1b5d032e5620f69f9f700ff0e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_045ae949cf0c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Bingbot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "045ae949cf0c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1788452714, "last_seen": 1789617348, "transport": "t", "ja3_hash": "c2bf86a009d42dd9c0371ae6474014f5", "ja3_variant_count": 3, "ja3_variants": [ "c2bf86a009d42dd9c0371ae6474014f5", "3af62d47203816a27bd33098dce4dd8b", "8361f30f628c6238eff033899d878e3b" ], "user_agents": { "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)": 1, "slack/26.08.40.0.90016107 (samsung SM-S916B; Android 16; store com.android.vending)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12i1504h2_8daaf6152771_ce6db83f2c68", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "ce6db83f2c68", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-18-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789431224, "last_seen": 1789431224, "transport": "t", "ja3_hash": "0418de22d706e126bef1088d93cb9de4", "ja3_variant_count": 1, "ja3_variants": [ "0418de22d706e126bef1088d93cb9de4" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_6ae18c926a97", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "6ae18c926a97", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-10-18-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789816520, "last_seen": 1789816520, "transport": "t", "ja3_hash": "29e69b087bb9d3b2a10923480d265244", "ja3_variant_count": 1, "ja3_variants": [ "29e69b087bb9d3b2a10923480d265244" ], "user_agents": { "Sogou web spider/4.0": 23 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_f74b1484f78c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f74b1484f78c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-23-5-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789695455, "last_seen": 1789695455, "transport": "t", "ja3_hash": "35419aadc6bfdff2d43a3ab9671eb8cb", "ja3_variant_count": 1, "ja3_variants": [ "35419aadc6bfdff2d43a3ab9671eb8cb" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_11627799d1d4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "11627799d1d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-16-65281-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789097076, "last_seen": 1789097076, "transport": "t", "ja3_hash": "92303393732623c2e67d5fe434e7ba81", "ja3_variant_count": 1, "ja3_variants": [ "92303393732623c2e67d5fe434e7ba81" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3a59c9940562", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3a59c9940562", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-65037-16-35-45-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789702696, "last_seen": 1789702696, "transport": "t", "ja3_hash": "904514155566cdc487937059d0e81c9b", "ja3_variant_count": 1, "ja3_variants": [ "904514155566cdc487937059d0e81c9b" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_97e3b743d3ba", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "97e3b743d3ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-16-5-45-10-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789665453, "last_seen": 1789665453, "transport": "t", "ja3_hash": "55fce89808c1ac6c3eb02e8d30422dbd", "ja3_variant_count": 1, "ja3_variants": [ "55fce89808c1ac6c3eb02e8d30422dbd" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t13d031200_55b375c5d22e_55ac72f97122", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python aiohttp \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d031200", "b": "55b375c5d22e", "c": "55ac72f97122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865,65281-0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788725723, "last_seen": 1789435841, "transport": "t", "ja3_hash": "1c48fac858875a4fce78dde2a602b093", "ja3_variant_count": 1, "ja3_variants": [ "1c48fac858875a4fce78dde2a602b093" ], "user_agents": { "Python/3.11 aiohttp/3.14.3": 2 }, "ua_disagreement": false } }, { "hash": "t13d0312h2_55b375c5d22e_91cb082f3657", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d0312h2", "b": "55b375c5d22e", "c": "91cb082f3657", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865,0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788725717, "last_seen": 1788725717, "transport": "t", "ja3_hash": "d24be7db5080cb337fcc018702787f84", "ja3_variant_count": 1, "ja3_variants": [ "d24be7db5080cb337fcc018702787f84" ], "user_agents": { "curl/8.18.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d101000_61a7ad8aa9b6_01def6fbf02e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "PerplexityBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "01def6fbf02e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-23-10-35-5-13-11-0-45-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 160, "first_seen": 1787567864, "last_seen": 1789912489, "transport": "t", "ja3_hash": "5cdcc9cc1ebed0136464371ac640d90f", "ja3_variant_count": 151, "ja3_variants": [ "5cdcc9cc1ebed0136464371ac640d90f", "6a15043f593bcd30c22970c194cd5cf2", "ae4de56710d6b80f000e5dca3d8fbef0", "8da829f28229706d148f7c39177ffc54", "47478c2bb7b91a62cda457f5c463cb0c", "b7de1ce029465d93f556b06028100571", "f97564838f0fda84748d2ae04ca992dd", "5331fcdb53219bd752bba158703f4a12", "b8850b280182f5b275a80670c3dd72c5", "eeaf414f702fd599b5b5f7f4e2cf21c1", "181385e6cb959f840de01a75628c4d16", "a35db4d4499b4ef0f8c4dac4e86cdcb5" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 8 }, "ua_disagreement": false } }, { "hash": "t13d101000_61a7ad8aa9b6_c46b846b2fb1", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "PerplexityBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "c46b846b2fb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-13-45-0-11-43-10-5-51-35,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1943, "first_seen": 1787716868, "last_seen": 1789957403, "transport": "t", "ja3_hash": "ac56f3eead6ad6bf18f51eac77a2bea1", "ja3_variant_count": 1895, "ja3_variants": [ "ac56f3eead6ad6bf18f51eac77a2bea1", "9ad0f27a8ece4a657342e7f3aae57641", "a2f811de9a0647402b09ed49d4056de1", "3aee9bc4e39917edc45e2f672a909fc7", "c0cd1cbac21271aaa159203eab55833f", "93c33c34e9bc9a82d3abd34d0dfa6c0a", "bc2b137e150e80e3b77fbfe3d0ca90a4", "f49fe5087766ad3bfed6e43336719b88", "dbb478f6287cd88c98b6aaaf486a2d7e", "36c74bb0c763ae8e59e8157b2da6719f", "941ba21b885f9def8ca5312c7dc38510", "e603a3f51e7a96a0b60211c67ee83eb9" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 1940, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d1011h2_18ef40b21276_6204cfc135c8", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "18ef40b21276", "c": "6204cfc135c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49200-52393-52392-49195-49199-49191,0-23-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1787537074, "last_seen": 1789842377, "transport": "t", "ja3_hash": "705a350d22d8835722a0a4ed7ff0d573", "ja3_variant_count": 1, "ja3_variants": [ "705a350d22d8835722a0a4ed7ff0d573" ], "user_agents": { "curl/8.7.1": 223 }, "ua_disagreement": false } }, { "hash": "t13d1011h2_61a7ad8aa9b6_861bc38b0be4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "ClaudeBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "861bc38b0be4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,0-10-23-43-51-5-11-16-45-35-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8029, "first_seen": 1787458584, "last_seen": 1789968093, "transport": "t", "ja3_hash": "7d906f69c5bc2c9770408e7bb3bf32e2", "ja3_variant_count": 7188, "ja3_variants": [ "7d906f69c5bc2c9770408e7bb3bf32e2", "30defea8353053e2dfecc0ff9c16ff3f", "ed56a1f376091f47e66c7b6d56c03492", "665006e81ca97edd67cfe82aa8ef064a", "b3702d33d4709e13cc4ede4382d572ec", "d648143fa42154725e77f3a1a486ae30", "a7eceb7a5bf4c35c3cbc15980a4ddc9e", "6ce46251f230ded04820ecbda1f16b08", "427e6ea1ccc1d6c8a0e41afb35493c75", "4ed37bf14db63b73e10cf737dd735ad8", "9c908d21c626482097edf9c087f01608", "645141504037ff577db5e59967469fb1" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 3240, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 (compatible; AionBot/1.0)": 583, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)": 5254, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 346, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 364, "crusader-worker/1.0": 45, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.2792.65": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.co": 332, "Mozilla/5.0 (compatible; Reflectionbot/1.0; +https://reflection.ai/bot)": 67, "PQCrypta-Discovery-Agent/1.0.45": 217, "PQCrypta-Discovery-Agent/1.0.38": 244, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)": 716, "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0": 31, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0": 33, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0": 25, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 1, "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0": 12, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Mobile Safari/537.36": 30, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15": 26, "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)": 3, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186]": 2, "Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.com)": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (compatible; GitFinder/1.0)": 4, "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.70 Safari/537.36 Vivaldi/6.7.3200.25": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0": 1, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6540.18 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; Xbox; Xbox One) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edge/44.18363.8131": 1 }, "ua_disagreement": true } }, { "hash": "t13d1011h2_61a7ad8aa9b6_ae9f20769a5d", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Qwantbot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "ae9f20769a5d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-23-43-10-35-13-16-5-45-11-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 110, "first_seen": 1788445080, "last_seen": 1789964272, "transport": "t", "ja3_hash": "0f582a05c31fe42de69b3589ba81dc8b", "ja3_variant_count": 110, "ja3_variants": [ "0f582a05c31fe42de69b3589ba81dc8b", "b9ca8cc5eb710a6be05c5b865e043639", "f0580f232e37417f5d769bf792333e99", "d2eb9216eab9e050bb89925a54775d80", "cf1c2607e185a9be09d6027abc07f4ce", "34272a679e64934b76711ea0bbd7e36a", "edf541b07988bf94657bcc71d0d697f5", "1efb6eae45cc34290f272e624e7de4da", "0bf65c16d4a5d6c14ba96bfbf13db3a6", "ef9ab3c4b000c0645ba4f6b8214a09c1", "8b052f8433122e27c01ef2139ccee1c7", "ae1f84fb52ae3672bcc8f7f37c3721c2" ], "user_agents": { "Mozilla/5.0 (compatible; Qwantbot/1.0; +https://help.qwant.com/bot/)": 131, "Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0": 3, "repology-linkchecker/1 (+https://repology.org/docs/bots)": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 3, "umi/1.0 (+https://umi.dev/bot)": 1 }, "ua_disagreement": true } }, { "hash": "t13d1011ht_61a7ad8aa9b6_ae9f20769a5d", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (ae9f20769a5d) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1011ht", "b": "61a7ad8aa9b6", "c": "ae9f20769a5d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-10-51-45-5-23-43-0-35-16-11,29-23-24-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788906169, "last_seen": 1789868924, "transport": "t", "ja3_hash": "b79d5fc7c1d3a54f95eb5a599dcf197f", "ja3_variant_count": 11, "ja3_variants": [ "b79d5fc7c1d3a54f95eb5a599dcf197f", "8c814fdce9dbd309986abb3bf843288f", "1f7bccd5632521b20aa9587ed4debe6d", "6162b9328dd980087081ece64dfbb7a9", "ca1df2d881d576c688c057b3860a5477", "53a6569d01b62f5e01293af3d91ad46c", "57cb79755a3321909cd58d23dcb09392", "f3509c1b3cd29d3fcc5b95876c9f8946", "46af0678eb2793e93c5a33c59fc8e393", "dea475c1040e49c5a512fce904839048", "7708ae5295b2b528b27e2dcee9b60b99" ], "user_agents": { "GitHubCopilotRuntime-WebFetch": 1, "Mozilla/5.0 (Macintosh) Brobot-Research/1.0": 1 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1113h2_5e2a75874763_0b2c8cf08c1b", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "CCBot (Common Crawl) \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1113h2", "b": "5e2a75874763", "c": "0b2c8cf08c1b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172,0-5-10-11-13-50-16-17-23-43-45-51-65281,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 19, "first_seen": 1788342654, "last_seen": 1789504780, "transport": "t", "ja3_hash": "4f0bda65793e2d63b24d640f10d7a51c", "ja3_variant_count": 1, "ja3_variants": [ "4f0bda65793e2d63b24d640f10d7a51c" ], "user_agents": { "CCBot/2.0 (https://commoncrawl.org/faq/)": 40 }, "ua_disagreement": false } }, { "hash": "t13d1114h2_5e2a75874763_352e3a9193bf", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "CCBot (Common Crawl) \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1114h2", "b": "5e2a75874763", "c": "352e3a9193bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172,0-5-10-11-13-50-16-17-23-43-45-51-65281-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 27, "first_seen": 1788410968, "last_seen": 1789509900, "transport": "t", "ja3_hash": "0a84269fcc8452ac11db9e0d0b6728db", "ja3_variant_count": 1, "ja3_variants": [ "0a84269fcc8452ac11db9e0d0b6728db" ], "user_agents": { "CCBot/2.0 (https://commoncrawl.org/faq/)": 73 }, "ua_disagreement": false } }, { "hash": "t13d121000_0ed44715e6cd_badae892920c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "C\u1ed1c C\u1ed1c bot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d121000", "b": "0ed44715e6cd", "c": "badae892920c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49196-49195-49199-49200-49171-49172-156-47-53,0-23-65281-10-11-35-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 95, "first_seen": 1787446539, "last_seen": 1789902947, "transport": "t", "ja3_hash": "ab1caf6ada0c339e22931167c1fd0e05", "ja3_variant_count": 2, "ja3_variants": [ "ab1caf6ada0c339e22931167c1fd0e05", "e5d57694631abb5452ce9ae9bd3b6d3d" ], "user_agents": { "Mozilla/5.0 (compatible; coccocbot-web/1.0; +http://help.coccoc.com/searchengine)": 36, "LinkedInBot/1.0 (compatible; Mozilla/5.0; Apache-HttpClient +http://www.linkedin.com)": 16, "Mozilla/5.0 (compatible; coccocbot-image/1.0; +http://help.coccoc.com/searchengine)": 38 }, "ua_disagreement": false } }, { "hash": "t13d121100_0ed44715e6cd_996dcf38c216", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "LinkedInBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d121100", "b": "0ed44715e6cd", "c": "996dcf38c216", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49196-49195-49199-49200-49171-49172-156-47-53,0-23-65281-10-11-35-13-51-45-43-41,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789742581, "last_seen": 1789742581, "transport": "t", "ja3_hash": "a0b9fbc7a85132d822cc23c44d648452", "ja3_variant_count": 1, "ja3_variants": [ "a0b9fbc7a85132d822cc23c44d648452" ], "user_agents": { "LinkedInBot/1.0 (compatible; Mozilla/5.0; Apache-HttpClient +http://www.linkedin.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1311h2_f57a46bbacb6_2f5041364463", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1311h2", "b": "f57a46bbacb6", "c": "2f5041364463", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-16-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 32, "first_seen": 1787475048, "last_seen": 1789489049, "transport": "t", "ja3_hash": "ceb419f4203d3159e7a7cb3aa7efd5bd", "ja3_variant_count": 2, "ja3_variants": [ "ceb419f4203d3159e7a7cb3aa7efd5bd", "50982bb7732015b00f10d5024747686f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 14, "Mozilla/5.0 (compatible; SparixEmailScraper/1.0; +https://sparix.ai)": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2, "Mozilla/5.0": 34, "Go-http-client/2.0": 17 }, "ua_disagreement": true } }, { "hash": "t13d1510h2_8daaf6152771_3e1e5eacdaa9", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "3e1e5eacdaa9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-16-23-5-45-18-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789943183, "last_seen": 1789943183, "transport": "t", "ja3_hash": "278e7ee6c0d40ca8a402240fbcdc91f7", "ja3_variant_count": 1, "ja3_variants": [ "278e7ee6c0d40ca8a402240fbcdc91f7" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t13d151100_1b8cdd526c76_bdb8e2a68208", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "1b8cdd526c76", "c": "bdb8e2a68208", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4867-4865-4866-156-52393-60-49196-49195-49200-49199-49191-47-49161-53-10,51-65281-23-35-5-13-0-10-43-45-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788858279, "last_seen": 1788858279, "transport": "t", "ja3_hash": "fb6d895b41182c7bf490c9fabfbdd8b2", "ja3_variant_count": 1, "ja3_variants": [ "fb6d895b41182c7bf490c9fabfbdd8b2" ], "user_agents": { "Go-http-client/1.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_aea78d538e14", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "DuckDuckGo app \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "aea78d538e14", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 32, "first_seen": 1787494417, "last_seen": 1789750616, "transport": "t", "ja3_hash": "1d714db2228763eab228fc28ce7f8e4f", "ja3_variant_count": 2, "ja3_variants": [ "1d714db2228763eab228fc28ce7f8e4f", "f79b6bad2ad0641e1921aef10262856b" ], "user_agents": { "DuckDuckGo/5 (com.duckduckgo.mobile.android; Android API 37)": 11, "Mozilla/5.0 (Linux; Android 8.0.0; SM-J330G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36 EdgA/114.0.1823.74": 2, "DuckDuckGo/5 (com.duckduckgo.mobile.android; Android API 36)": 8, "GoogleMessages/20.2 facebookexternalhit/1.1 Facebot Twitterbot/1.0": 2, "slack/26.08.40.0.90016107 (samsung SM-S901B; Android 16; store com.android.vending)": 3, "slack/26.08.40.0.90016107 (samsung SM-S911B; Android 16; store com.android.vending)": 3 }, "ua_disagreement": true } }, { "hash": "t13d1514h2_8daaf6152771_3c2c2e3469bf", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "3c2c2e3469bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-13-5-23-0-43-65037-35-17613-27-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788780836, "last_seen": 1789431222, "transport": "t", "ja3_hash": "4c29315b4c76f147fe01271dac2fa51e", "ja3_variant_count": 2, "ja3_variants": [ "4c29315b4c76f147fe01271dac2fa51e", "31d8d46271bb57de49a5cd4cefa0ec1c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 10 }, "ua_disagreement": true } }, { "hash": "t13d160900_6d57ae910dcb_73b007f92d04", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d160900", "b": "6d57ae910dcb", "c": "73b007f92d04", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4867-4866-60-49196-49200-156-49195-52393-52392-49187-10-47-49170-49161-49172,45-65281-5-0-18-35-10-43-51,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789304613, "last_seen": 1789304613, "transport": "t", "ja3_hash": "373d937c28ac363f0b372884eea7bff9", "ja3_variant_count": 1, "ja3_variants": [ "373d937c28ac363f0b372884eea7bff9" ], "user_agents": { "Go-http-client/1.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1616h2_46e7e9700bed_f6824c026247", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1616h2", "b": "46e7e9700bed", "c": "f6824c026247", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-30032-11-51-45-43-10-27-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 30032, "name": "30032 (0x7550)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1787497308, "last_seen": 1789815064, "transport": "t", "ja3_hash": "6a958df291c3f2ee216e80434750d4e1", "ja3_variant_count": 1, "ja3_variants": [ "6a958df291c3f2ee216e80434750d4e1" ], "user_agents": { "Go-http-client/2.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 OPR/89.0.4447.98": 1 }, "ua_disagreement": true } }, { "hash": "t13d171000_5b57614c22b0_badae892920c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Claude-User \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d171000", "b": "5b57614c22b0", "c": "badae892920c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-13-51-45-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1789075011, "last_seen": 1789921227, "transport": "t", "ja3_hash": "203503b7023848ab87b9836c336b8e81", "ja3_variant_count": 1, "ja3_variants": [ "203503b7023848ab87b9836c336b8e81" ], "user_agents": { "Dart/3.11 (dart:io)": 8, "Claude-User (claude-code/2.1.228; +https://support.anthropic.com/)": 2, "Claude-User (claude-code/2.1.196; +https://support.anthropic.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1713ht_ab0a1bf427ad_23c7dd8c4d5c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "ab0a1bf427ad", "c": "23c7dd8c4d5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 71, "first_seen": 1787444799, "last_seen": 1789504586, "transport": "t", "ja3_hash": "86dab2109182b6bbaa644647d7db2997", "ja3_variant_count": 1, "ja3_variants": [ "86dab2109182b6bbaa644647d7db2997" ], "user_agents": { "python-requests/2.33.1": 52, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0 Safari/537.36 NWSIP-Stage1": 2, "Mozilla/5.0 (compatible; url-crawler/1.0)": 7 }, "ua_disagreement": true } }, { "hash": "t13d1715h2_5b57614c22b0_2b6791c0b3dd", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1715h2", "b": "5b57614c22b0", "c": "2b6791c0b3dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-21,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1787459792, "last_seen": 1789807853, "transport": "t", "ja3_hash": "579ccef312d18482fc42e2b822ca2430", "ja3_variant_count": 1, "ja3_variants": [ "579ccef312d18482fc42e2b822ca2430" ], "user_agents": { "Go-http-client/2.0": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:115.0) Gecko/20100101 /115.42.0": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:115.0) Gecko/20100101 /115.41.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d181000_0b3ac25db417_282979f8dc72", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181000", "b": "0b3ac25db417", "c": "282979f8dc72", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49200-49196-49195-52392-49187-49199-49191-52393-157-156-49171-49170-47-49161-53,51-43-35-45-0-11-5-10-65281-13,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789721640, "last_seen": 1789721640, "transport": "t", "ja3_hash": "49185a94c0c857c72b0738a235d97ca4", "ja3_variant_count": 1, "ja3_variants": [ "49185a94c0c857c72b0738a235d97ca4" ], "user_agents": { "Go-http-client/1.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d181000_5d04281c6031_badae892920c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Claude-User \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181000", "b": "5d04281c6031", "c": "badae892920c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49199-49195-49200-49196-49191-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-13-51-45-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788536356, "last_seen": 1789304233, "transport": "t", "ja3_hash": "5355e3851d76d069ab8a98fdb51cf1b4", "ja3_variant_count": 1, "ja3_variants": [ "5355e3851d76d069ab8a98fdb51cf1b4" ], "user_agents": { "Claude-User (claude-code/2.1.266; +https://support.anthropic.com/)": 2, "Claude-User (claude-code/2.1.260; +https://support.anthropic.com/)": 5, "Claude-User (claude-code/2.1.270; +https://support.anthropic.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t13d181300_e8a523a41297_184ca06a0196", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Googlebot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181300", "b": "e8a523a41297", "c": "184ca06a0196", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-52393-52392-49196-49200-49161-49171-49162-49172-156-157-47-53-10,0-23-65281-10-11-35-5-13-18-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8516, "first_seen": 1787442675, "last_seen": 1789968310, "transport": "t", "ja3_hash": "b4da7f95e46bf2cf5285fd609cf726e4", "ja3_variant_count": 1, "ja3_variants": [ "b4da7f95e46bf2cf5285fd609cf726e4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.137 Mobile Safari/537.36 (compatible; GoogleOther)": 145, "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.137 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.": 541, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 2522 }, "ua_disagreement": true } }, { "hash": "t13d1815h2_e8a523a41297_2b6791c0b3dd", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1815h2", "b": "e8a523a41297", "c": "2b6791c0b3dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-21,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1787507642, "last_seen": 1789691346, "transport": "t", "ja3_hash": "6b5e0cfe988c723ee71faf54f8460684", "ja3_variant_count": 1, "ja3_variants": [ "6b5e0cfe988c723ee71faf54f8460684" ], "user_agents": { "Go-http-client/2.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d190900_9dc949149365_a38838ecc1fa", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Baiduspider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d190900", "b": "9dc949149365", "c": "a38838ecc1fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 787, "first_seen": 1787445454, "last_seen": 1789966933, "transport": "t", "ja3_hash": "473cd7cb9faa642487833865d516e578", "ja3_variant_count": 4, "ja3_variants": [ "473cd7cb9faa642487833865d516e578", "1f24dbdea9cbd448a034e5d87c14168f", "df669e7ea913f1ac0c0cce9a201a2ec1", "75395445c5b459a9809fdda2daeef677" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (compatible; Baiduspider-render/2.0; +http://www.baidu.com/search/spider.html)": 369, "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)": 107, "visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36": 48, "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; MDDCJS; rv:11.0) like Gecko": 1, "Go-http-client/1.1": 6, "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.143 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d191000_9dc949149365_27f0a1fdd87d", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d191000", "b": "9dc949149365", "c": "27f0a1fdd87d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-5-10-11-13-65281-23-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 46, "first_seen": 1787475197, "last_seen": 1789929008, "transport": "t", "ja3_hash": "1be8360b66649edee1de25f81d98ec27", "ja3_variant_count": 2, "ja3_variants": [ "1be8360b66649edee1de25f81d98ec27", "6f298f9c6526379529df529f91fc2557" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0": 6, "Mozilla/5.0 (X11; Linux x86_64)": 4, "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 Edg/118.0.0.0": 1, "Go-http-client/1.1": 15, "Mozilla/5.0 (compatible; SemrushBot-BA; +http://www.semrush.com/bot.html)": 14 }, "ua_disagreement": true } }, { "hash": "t13d1911h2_9dc949149365_2f5041364463", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1911h2", "b": "9dc949149365", "c": "2f5041364463", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-11-65281-23-18-5-10-13-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 61, "first_seen": 1787488747, "last_seen": 1789826685, "transport": "t", "ja3_hash": "d1d19c71e48184c6bf6827a3fea5da87", "ja3_variant_count": 2, "ja3_variants": [ "d1d19c71e48184c6bf6827a3fea5da87", "7a15285d4efc355608b304698cd7f9ab" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36": 10, "metadata.party/1.0 (+https://github.com/yourusername/metadata.party)": 1, "Go-http-client/2.0": 43, "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36": 43, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.3": 3 }, "ua_disagreement": true } }, { "hash": "t13d2012h2_272d1fb6f253_654875230aab", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2012h2", "b": "272d1fb6f253", "c": "654875230aab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-52392-49200-52393-60-157-156-49199-49187-49195-49196-49161-10-49170-49172-49171-47-53,16-45-10-51-43-17513-11-18-35-0-23-13,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788603934, "last_seen": 1788603934, "transport": "t", "ja3_hash": "13956809fa5c182adaae30aa0dd2b623", "ja3_variant_count": 1, "ja3_variants": [ "13956809fa5c182adaae30aa0dd2b623" ], "user_agents": { "Go-http-client/2.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d2013ht_2b729b4bf6f3_b9165cb4b096", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2013ht", "b": "2b729b4bf6f3", "c": "b9165cb4b096", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-5-43-13-35-10-11-16-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788937266, "last_seen": 1788937285, "transport": "t", "ja3_hash": "fae0e5d973c96ae1888b99538efa0363", "ja3_variant_count": 1, "ja3_variants": [ "fae0e5d973c96ae1888b99538efa0363" ], "user_agents": { "curl/8.21.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d250900_b78ed14e2fd0_a38838ecc1fa", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (a38838ecc1fa) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d250900", "b": "b78ed14e2fd0", "c": "a38838ecc1fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 25, "extension_count": 9, "alpn": null } }, "ja3_string": "771,10-47-53-156-157-49161-49162-49170-49171-49172-49195-49196-49199-49200-52392-52393-5-60-49159-49169-49187-49191-4867-4865-4866,0-5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787969612, "last_seen": 1789792891, "transport": "t", "ja3_hash": "ab9a771514223079d9b13419b45c50c7", "ja3_variant_count": 1, "ja3_variants": [ "ab9a771514223079d9b13419b45c50c7" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d260900_3309cf098094_a38838ecc1fa", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (a38838ecc1fa) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d260900", "b": "3309cf098094", "c": "a38838ecc1fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 26, "extension_count": 9, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49161-158-52392-52394-51-61-22-49162-57-49171-10-49172-156-157-47-53-49170-4867-4865-4866,0-5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 24, "first_seen": 1787995887, "last_seen": 1789940888, "transport": "t", "ja3_hash": "43421e3931de5c5355809e68ec542a8d", "ja3_variant_count": 1, "ja3_variants": [ "43421e3931de5c5355809e68ec542a8d" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d291300_723694b0fccc_ff9189fa9ce3", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "wget \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d291300", "b": "723694b0fccc", "c": "ff9189fa9ce3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 29, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-52393-49325-49162-49195-49324-49161-49200-52392-49172-49199-49171-157-49309-53-156-49308-47-159-52394-49311-57-158-49310-51,65281-13-0-43-11-35-5-49-28-51-45-10-21,23-24-25-29-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789496454, "last_seen": 1789496454, "transport": "t", "ja3_hash": "9722ed5304debc3067288b8876635ae1", "ja3_variant_count": 1, "ja3_variants": [ "9722ed5304debc3067288b8876635ae1" ], "user_agents": { "Wget/1.25.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d3013h2_1d37bd780c83_23c7dd8c4d5c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "PQCrypta IP heartbeat \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3013h2", "b": "1d37bd780c83", "c": "23c7dd8c4d5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 14327, "first_seen": 1787442797, "last_seen": 1789968439, "transport": "t", "ja3_hash": "32e4b8812cda0c0d50783b438492a769", "ja3_variant_count": 2, "ja3_variants": [ "32e4b8812cda0c0d50783b438492a769", "7a73fb0bdeaa2a79fadf356c34e7577e" ], "user_agents": { "pqcrypta-ip-update/1.0 (us-midwest heartbeat)": 7386, "Mozilla/5.0 (X11; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 371, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d3013ht_1d37bd780c83_99c94103f5e0", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python aiohttp \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3013ht", "b": "1d37bd780c83", "c": "99c94103f5e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7839, "first_seen": 1787442804, "last_seen": 1789921749, "transport": "t", "ja3_hash": "8ecf4858a704c8936042f20a8bedee04", "ja3_variant_count": 1, "ja3_variants": [ "8ecf4858a704c8936042f20a8bedee04" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2, "Python/3.14 aiohttp/3.14.1": 10, "Mozilla/5.0 (compatible; GlobRadarBot/1.0; +https://globradar.com/bot)": 51 }, "ua_disagreement": true } }, { "hash": "t13d3014ht_1d37bd780c83_ed8524ea7a97", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3014ht", "b": "1d37bd780c83", "c": "ed8524ea7a97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 17, "first_seen": 1788093989, "last_seen": 1789746050, "transport": "t", "ja3_hash": "88f1fd7a4ad8bf2abd56176f5455424b", "ja3_variant_count": 1, "ja3_variants": [ "88f1fd7a4ad8bf2abd56176f5455424b" ], "user_agents": { "Mozilla/5.0 (compatible; SiteScan/1.0; read-mostly QA gate; respects robots)": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 4, "Python-urllib/3.14": 2 }, "ua_disagreement": false } }, { "hash": "t13d311000_e8f1e7e78f70_436cb0bc5860", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "OkHttp \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311000", "b": "e8f1e7e78f70", "c": "436cb0bc5860", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 48, "first_seen": 1787463146, "last_seen": 1789716591, "transport": "t", "ja3_hash": "5cc600468c246704e1699c12f51eb3ab", "ja3_variant_count": 1, "ja3_variants": [ "5cc600468c246704e1699c12f51eb3ab" ], "user_agents": { "okhttp/3.0": 7, "Mozilla/5.0 (iPod; U; CPU iPhone OS 3_2 like Mac OS X; ig-NG) AppleWebKit/535.30.4 (KHTML, like Gecko) Version/4.0.5 Mobile/8B115 Safari/6535.30.4": 1, "Opera/9.58.(X11; Linux i686; fr-CA) Presto/2.9.182 Version/11.00": 1 }, "ua_disagreement": true } }, { "hash": "t13d311000_e8f1e7e78f70_7ef8eb972a3c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311000", "b": "e8f1e7e78f70", "c": "7ef8eb972a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 298, "first_seen": 1787471742, "last_seen": 1789965084, "transport": "t", "ja3_hash": "a267e5aa93a4cd7f93a715ac4491fa0b", "ja3_variant_count": 2, "ja3_variants": [ "a267e5aa93a4cd7f93a715ac4491fa0b", "40adfd923eb82b89d8836ba37a19bca1" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 262, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36": 21, "ALittle Client": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d3112h2_e8f1e7e78f70_9d3cd320fc9b", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Baiduspider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112h2", "b": "e8f1e7e78f70", "c": "9d3cd320fc9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 30, "first_seen": 1787478204, "last_seen": 1789786570, "transport": "t", "ja3_hash": "976771cc12ab6391a021ebc6c1d77991", "ja3_variant_count": 1, "ja3_variants": [ "976771cc12ab6391a021ebc6c1d77991" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36": 9, "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)": 21 }, "ua_disagreement": true } }, { "hash": "t13d3112ht_1d947a95fc68_68567893068e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "SeznamBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112ht", "b": "1d947a95fc68", "c": "68567893068e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-13-50-16-17-23-43-45-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 599, "first_seen": 1787443878, "last_seen": 1789964144, "transport": "t", "ja3_hash": "dc78674c6c856f9f22389e8180ee8350", "ja3_variant_count": 1, "ja3_variants": [ "dc78674c6c856f9f22389e8180ee8350" ], "user_agents": { "Mozilla/5.0 (compatible; SeznamBot/4.0; +https://o-seznam.cz/napoveda/vyhledavani/en/seznambot-crawler/)": 598 }, "ua_disagreement": false } }, { "hash": "t13d3112ht_e8f1e7e78f70_64f78f54e6a2", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "YandexBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112ht", "b": "e8f1e7e78f70", "c": "64f78f54e6a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1468, "first_seen": 1787448901, "last_seen": 1789963461, "transport": "t", "ja3_hash": "bc29aa426fc99c0be1b9be941869f88a", "ja3_variant_count": 1, "ja3_variants": [ "bc29aa426fc99c0be1b9be941869f88a" ], "user_agents": { "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)": 1434, "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0": 30, "Mozilla/5.0 (compatible; YandexRenderResourcesBot/1.0; +http://yandex.com/bots) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0": 35 }, "ua_disagreement": true } }, { "hash": "t13d3112ht_e8f1e7e78f70_6c7c91134a62", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python aiohttp \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112ht", "b": "e8f1e7e78f70", "c": "6c7c91134a62", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 169, "first_seen": 1787523160, "last_seen": 1789880800, "transport": "t", "ja3_hash": "3adacb99ecb51ed59c4f6c4ed9a7dcaa", "ja3_variant_count": 2, "ja3_variants": [ "3adacb99ecb51ed59c4f6c4ed9a7dcaa", "657a105ca838d7171613c035060a5fed" ], "user_agents": { "Python/3.12 aiohttp/3.14.3": 6, "Datiobot/0.1 (+https://datio-phi.vercel.app)": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36": 12, "Mozilla/5.0 (Linux; U; Android 12; zh-Hans-CN; JAD-AL50 Build/HUAWEIJAD-AL50) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/100.0.4896.58 Quark/7.6.5.720 Mobile Safari/": 2, "Python/3.9 aiohttp/3.13.5": 13 }, "ua_disagreement": true } }, { "hash": "t13d3113ht_1d947a95fc68_1a43a4b4e342", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "SeznamBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3113ht", "b": "1d947a95fc68", "c": "1a43a4b4e342", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-13-50-16-17-23-43-45-51-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787670821, "last_seen": 1789952898, "transport": "t", "ja3_hash": "50574dd847067a3a4d2cdfb9fde0248a", "ja3_variant_count": 1, "ja3_variants": [ "50574dd847067a3a4d2cdfb9fde0248a" ], "user_agents": { "Mozilla/5.0 (compatible; SeznamBot/4.0; +https://o-seznam.cz/napoveda/vyhledavani/en/seznambot-crawler/)": 7 }, "ua_disagreement": false } }, { "hash": "t13d4907h2_0d8feac7bc37_f58b2dd76f93", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d4907h2", "b": "0d8feac7bc37", "c": "f58b2dd76f93", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865-52393-52392-52394-49200-49196-49192-49188-49172-49162-159-107-57-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-49169-49159-5-4-49170-49160-22-10-255,43-51-0-11-10-13-16,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 51, "first_seen": 1787472775, "last_seen": 1789787799, "transport": "t", "ja3_hash": "375c6162a492dfbf2795909110ce8424", "ja3_variant_count": 1, "ja3_variants": [ "375c6162a492dfbf2795909110ce8424" ], "user_agents": { "Mozilla/5.0": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 2, "curl/8.7.1": 36 }, "ua_disagreement": true } }, { "hash": "t13d491200_bd868743f55c_f0d148687978", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "LinkedInBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d491200", "b": "bd868743f55c", "c": "f0d148687978", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 685, "first_seen": 1787488888, "last_seen": 1789964848, "transport": "t", "ja3_hash": "8bd06f4341a65d44a68bd2cef7cbedc6", "ja3_variant_count": 1, "ja3_variants": [ "8bd06f4341a65d44a68bd2cef7cbedc6" ], "user_agents": { "Mozilla/5.0 (compatible; Barkrowler/0.9; +https://babbar.tech/crawler)": 26, "Mozilla/5.0 (compatible; IbouBot/1.0; +bot@ibou.io; +https://ibou.io/iboubot.html)": 17, "LinkedInBot/1.0 (compatible; Mozilla/5.0; Apache-HttpClient +http://www.linkedin.com)": 53 }, "ua_disagreement": true } }, { "hash": "t13d7512ht_479067518aa3_d89d4c7b8e02", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d7512ht", "b": "479067518aa3", "c": "d89d4c7b8e02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 75, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1787621173, "last_seen": 1788460638, "transport": "t", "ja3_hash": "8a889e7a3d15642aeb93d20a85a5a1ca", "ja3_variant_count": 1, "ja3_variants": [ "8a889e7a3d15642aeb93d20a85a5a1ca" ], "user_agents": { "python-requests/2.31.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i131100_f57a46bbacb6_9249cab70c77", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Amazonbot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i131100", "b": "f57a46bbacb6", "c": "9249cab70c77", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-35-65281-23-18-5-10-13-43-51-45,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 20, "first_seen": 1787501117, "last_seen": 1789208918, "transport": "t", "ja3_hash": "d8e37a40e57dedd5cdf50f846ffca8f8", "ja3_variant_count": 1, "ja3_variants": [ "d8e37a40e57dedd5cdf50f846ffca8f8" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)": 2, "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)": 3, "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)": 5 }, "ua_disagreement": false } }, { "hash": "t13i1311h2_f57a46bbacb6_d86ca3cca451", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1311h2", "b": "f57a46bbacb6", "c": "d86ca3cca451", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-16-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 60, "first_seen": 1787461152, "last_seen": 1789965092, "transport": "t", "ja3_hash": "8c5b2f378e481f94b4f82c131798f4d4", "ja3_variant_count": 3, "ja3_variants": [ "8c5b2f378e481f94b4f82c131798f4d4", "ee4dbd7875058c5fdff9c33a744fc786", "d5de6ac0e5cfb85b9a91508128424b99" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.1; itel it1407 Build/LMY47D) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/39.0.0.0 Mobile Safari/537.36": 5, "Mozilla/5.0 (Linux; U; Android 2.2; en-us; Droid Build/FRG22D) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1": 5, "curl/7.74.0": 32 }, "ua_disagreement": true } }, { "hash": "t13i1311ht_f57a46bbacb6_2cdfc78a0766", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1311ht", "b": "f57a46bbacb6", "c": "2cdfc78a0766", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789659607, "last_seen": 1789659607, "transport": "t", "ja3_hash": "725adce2954b00db40fdbba678c7ead8", "ja3_variant_count": 1, "ja3_variants": [ "725adce2954b00db40fdbba678c7ead8" ], "user_agents": { "Go-http-client/1.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i140900_cbb2034c60b8_e7c285222651", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i140900", "b": "cbb2034c60b8", "c": "e7c285222651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 14, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 169, "first_seen": 1787451686, "last_seen": 1789808190, "transport": "t", "ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7", "ja3_variant_count": 2, "ja3_variants": [ "ea4a9ae049cfc614efbb3c244abb3fc7", "1487bd354c20f20dd642bebc7f706e95" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 47, "net-research-scan/1.0 (+https://example.org/scan-info; abuse contact)": 3, "Go-http-client/1.1": 70, "Mozilla/5.0": 52, "-": 52 }, "ua_disagreement": true } }, { "hash": "t13i1811ht_85036bcba153_aaee209e3cc1", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1811ht", "b": "85036bcba153", "c": "aaee209e3cc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 109, "first_seen": 1787577817, "last_seen": 1789953984, "transport": "t", "ja3_hash": "b885946e72ad51dca6c70abc2f773506", "ja3_variant_count": 2, "ja3_variants": [ "b885946e72ad51dca6c70abc2f773506", "4b510481e2e54d5956f56d2177fb122d" ], "user_agents": { "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36": 2, "python-requests/2.32.5": 38 }, "ua_disagreement": true } }, { "hash": "t13i190900_9dc949149365_e7c285222651", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i190900", "b": "9dc949149365", "c": "e7c285222651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 59, "first_seen": 1787475208, "last_seen": 1789901142, "transport": "t", "ja3_hash": "9460af62ae0af667130bf0d36514f084", "ja3_variant_count": 2, "ja3_variants": [ "9460af62ae0af667130bf0d36514f084", "d6828e30ab66774a91a96ae93be4ae4c" ], "user_agents": { "NTRIP GNSSInternetRadio": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 14, "Go-http-client/1.1": 19, "HTTP Banner Detection (https://security.ipip.net)": 1 }, "ua_disagreement": true } }, { "hash": "t13i191000_9dc949149365_e5728521abd4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i191000", "b": "9dc949149365", "c": "e5728521abd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 100, "first_seen": 1787571429, "last_seen": 1789815034, "transport": "t", "ja3_hash": "96458b3de39df5d47bc5c4a9f10f8f26", "ja3_variant_count": 2, "ja3_variants": [ "96458b3de39df5d47bc5c4a9f10f8f26", "cc66f637ab6a9fd90b341744adf47775" ], "user_agents": { "l9explore/1.2.2": 55, "l9tcpid/v1.1.0": 8, "Go-http-client/1.1": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15": 2 }, "ua_disagreement": true } }, { "hash": "t13i3011ht_1d37bd780c83_703f33515997", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3011ht", "b": "1d37bd780c83", "c": "703f33515997", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789509444, "last_seen": 1789732946, "transport": "t", "ja3_hash": "c0d0aa2585613528b3a18d77f6675913", "ja3_variant_count": 1, "ja3_variants": [ "c0d0aa2585613528b3a18d77f6675913" ], "user_agents": { "curl/8.14.1": 1, "Mozilla/5.0 (compatible; URLScanner/1.0)": 5 }, "ua_disagreement": false } }, { "hash": "t13i3111h2_e8f1e7e78f70_aaee209e3cc1", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3111h2", "b": "e8f1e7e78f70", "c": "aaee209e3cc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 60, "first_seen": 1788139570, "last_seen": 1789961662, "transport": "t", "ja3_hash": "78f0dc5ac5b19daf131a133cfdee9691", "ja3_variant_count": 1, "ja3_variants": [ "78f0dc5ac5b19daf131a133cfdee9691" ], "user_agents": { "curl/8.18.0-DEV": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64)": 25, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 3 }, "ua_disagreement": true } }, { "hash": "t13i3111ht_e8f1e7e78f70_a3954c448de3", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python aiohttp \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3111ht", "b": "e8f1e7e78f70", "c": "a3954c448de3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787831226, "last_seen": 1789450386, "transport": "t", "ja3_hash": "755cbaaa441626ab9e759e8982278df5", "ja3_variant_count": 1, "ja3_variants": [ "755cbaaa441626ab9e759e8982278df5" ], "user_agents": { "PAN GlobalProtect": 4, "Python/3.12 aiohttp/3.13.5": 2, "python-urllib3/2.7.0": 28 }, "ua_disagreement": false } }, { "hash": "t13i3514h2_bfa337485184_45c22c8f5b22", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3514h2", "b": "bfa337485184", "c": "45c22c8f5b22", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 35, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-11-10-13172-16-22-23-49-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789042921, "last_seen": 1789042921, "transport": "t", "ja3_hash": "63ca17cf3b8345665a5c45e90ffeb33e", "ja3_variant_count": 1, "ja3_variants": [ "63ca17cf3b8345665a5c45e90ffeb33e" ], "user_agents": { "curl/7.76.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i3611ht_bcee18a5b459_703f33515997", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3611ht", "b": "bcee18a5b459", "c": "703f33515997", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 36, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47,65281-11-10-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788194739, "last_seen": 1789476865, "transport": "t", "ja3_hash": "df8a7a28712bb53e19abf4ac9802fcd3", "ja3_variant_count": 1, "ja3_variants": [ "df8a7a28712bb53e19abf4ac9802fcd3" ], "user_agents": { "python-requests/2.32.5": 3 }, "ua_disagreement": false } }, { "hash": "t13i3612ht_bcee18a5b459_cde28b4b7b1f", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3612ht", "b": "bcee18a5b459", "c": "cde28b4b7b1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 36, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47,65281-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 36, "first_seen": 1787558096, "last_seen": 1789931014, "transport": "t", "ja3_hash": "d18b223ce817c861b7829130500395c2", "ja3_variant_count": 1, "ja3_variants": [ "d18b223ce817c861b7829130500395c2" ], "user_agents": { "python-requests/2.32.5": 25, "python-requests/2.34.2": 5, "Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/50.0.3059.92 Safari/537.32": 1 }, "ua_disagreement": true } }, { "hash": "t13i4311ht_c7886603b240_14507d565a4b", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python httpx \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i4311ht", "b": "c7886603b240", "c": "14507d565a4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 43, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789535504, "last_seen": 1789535504, "transport": "t", "ja3_hash": "84bc44295bff30cae5acbf6b6461242e", "ja3_variant_count": 1, "ja3_variants": [ "84bc44295bff30cae5acbf6b6461242e" ], "user_agents": { "python-httpx/0.27.0": 2 }, "ua_disagreement": false } }, { "hash": "q13d0310h3_55b375c5d22e_85bcee6495dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0310h3", "b": "55b375c5d22e", "c": "85bcee6495dd", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 10, "alpn": "h3" } }, "ja3_string": "771,4867-4865-4866,27-43-57-51-16-13-0-17513-45-10,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 14, "first_seen": 1788567472, "last_seen": 1789900596, "transport": "q", "ja3_hash": "917d4ff918c24b24273cb5e4b750a392", "ja3_variant_count": 14, "ja3_variants": [ "917d4ff918c24b24273cb5e4b750a392", "6660763d347770520fc6d0db7adf9c32", "693a5b28ce544303805530643a37495c", "3acc9be08663b630e73665c650ebc690", "2de744e5fa898795cadd0f34af6e7119", "c94be6b093daca916ee93d77de6abdfb", "7f8f9cfc954524e56dcaa57e49ae5bee", "bd80cd42471c1cbd33a327c4f83dd1a9", "19dfa70a71ca416c16b129a46438404c", "4a1599b4644da876f102472d3027cafd", "0f2dcccfeb52c1ba5e7461b584de3768", "3971c1853ad0335af1140207dd63547b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Mobile/15E148 Safari/604.1": 75, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/114.0.5720.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36": 60, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15": 9 }, "ua_disagreement": true } }, { "hash": "q13d0311h3_55b375c5d22e_00d49a47e7d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "00d49a47e7d1", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,10-16-57-45-13-51-65037-43-27-17513-0,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 7, "first_seen": 1788460638, "last_seen": 1789449807, "transport": "q", "ja3_hash": "545ec20959a7f012cfd66dfbd7d67ff0", "ja3_variant_count": 7, "ja3_variants": [ "545ec20959a7f012cfd66dfbd7d67ff0", "330c6f44f410b98e7faf7a98d1900d80", "43d56a1330872c15cd59a003ea511df6", "17a6afe8f7023de9860d0f571f00149c", "5322e78ad093486676f724f053a67ffb", "517a0accc488aaeb9724326e5fc9bb94", "a4c8f3de95eece6c0569018a14e5fa73" ], "user_agents": { "Mozilla/5.0 (Linux; arm_64; Android 15; 2505DRP06G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.94 YaBrowser/25.4.5.94.01 Safari/537.36": 18, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0": 2 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_2680ea4b03be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "2680ea4b03be", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-0-43-5-16-34-13-51-28-10-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788727401, "last_seen": 1788727510, "transport": "q", "ja3_hash": "3ff1351e93027ca6fe52733bd6f2dab6", "ja3_variant_count": 2, "ja3_variants": [ "3ff1351e93027ca6fe52733bd6f2dab6", "be6737014bc03094c57d5fe1515c5c60" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 38 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_36ae49fd04fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "36ae49fd04fe", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865,0-10-16-5-13-18-51-45-43-57-27,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 259, "first_seen": 1787488752, "last_seen": 1789862316, "transport": "q", "ja3_hash": "48d08f334704479db85d91df80039756", "ja3_variant_count": 3, "ja3_variants": [ "48d08f334704479db85d91df80039756", "9a78264e64e221797705e75a3c55df01", "2f9431e877b01e163774ae4ae0df9ded" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/152.0.7977.53 Mobile/15E148 Safari/604.1": 271, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1": 105, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) EdgiOS/151.0.4129.72 Version/26.0 Mobile/15E148 Safari/604.1": 1738, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15": 11, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1": 31, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Safari/605.1.15 Ddg/26.5": 128 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_82b1eba68007", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "82b1eba68007", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-45-27-10-13-43-57-16-65037-51-17613,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1721, "first_seen": 1788441813, "last_seen": 1789964321, "transport": "q", "ja3_hash": "c618736c5099bc0810618267f69a71f1", "ja3_variant_count": 1721, "ja3_variants": [ "c618736c5099bc0810618267f69a71f1", "461eb0406ec73d65539cd6b91c21dd39", "0ffddb95530b0e0e0dcd5dacc91ceae3", "dbc12cc6760688f5f6f83d1157f0aa50", "5179d97fe8dd5f8e1e032a5e5228fb89", "329061d1f47071bde9b035ee8d80303f", "02d7b4643ca74657134dae211714448f", "a756610dadae694fd8980c4f7b152116", "45c914d9e6d2d81818d145aeb815bb87", "e3f7e5bde3045bcb3ebd382d9f0a72bc", "7b2e1fbc381d163842cd1ce990357b38", "22d819c2079fe475e8d44a494078615d" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.4 Safari/537.36": 2513, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 448, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 4495, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 422, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 4070, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.250 Electron/43.5.1 Safari/537.36 KimiDesktop/3.2.6(Kimi-Work)": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 112, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1978, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 92, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 213, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1": 247, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 95, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 57, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 281, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 244, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 87, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 268, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.175 Safari/537.36": 197, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 268, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0": 35, "RootEvidence/1.0": 140, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 45, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Claude/1.49585.0 Chrome/152.0.7977.76 Safari/537.36": 19, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 38, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 179, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.162 Safari/537.36": 107, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 OPR/135.0.0.0": 34, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/116.0.0.0 Safari/537.36": 40, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.163 Safari/537.36": 149, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36 OPR/101.0.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.7390.0 Safari/537.36": 150, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.34 Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 28, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 40, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.3856.97": 61, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 EdgA/146.0.0.0": 8, "Mozilla/5.0 (X11; CrOS x86_64 14150.87.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.124 Safari/537.36": 6, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 49, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 27, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 97, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0": 24, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 38, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 33, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 AVG/151.0.0.0": 26, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 YaBrowser/26.6.0.0 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.7778.96 Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 2, "HanaleiBot runid=beta-stage-integration-test": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 27, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 38, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 29, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "q13d0312h3_55b375c5d22e_08ad80460652", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "08ad80460652", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,65037-10-43-45-27-57-16-51-0-13-17513-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788555915, "last_seen": 1788555915, "transport": "q", "ja3_hash": "b37fea1b291ec2f8d7f15080574d5122", "ja3_variant_count": 1, "ja3_variants": [ "b37fea1b291ec2f8d7f15080574d5122" ], "user_agents": { "Mozilla/5.0 (Linux; arm_64; Android 15; 2505DRP06G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.94 YaBrowser/25.4.5.94.01 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_35ab28bf858e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "35ab28bf858e", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865,0-10-16-5-13-18-51-45-43-57-27-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 348, "first_seen": 1787488766, "last_seen": 1789866446, "transport": "q", "ja3_hash": "94f0e94ff0087a03f09b681a965a4d96", "ja3_variant_count": 1, "ja3_variants": [ "94f0e94ff0087a03f09b681a965a4d96" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/152.0.7977.53 Mobile/15E148 Safari/604.1": 134, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Safari/605.1.15": 24, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1": 62 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_c5d60a76a678", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "c5d60a76a678", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,65037-0-17613-13-27-16-45-57-43-4832-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 8, "first_seen": 1788481434, "last_seen": 1789754320, "transport": "q", "ja3_hash": "1548284409ad6d5583a05409ac78f458", "ja3_variant_count": 8, "ja3_variants": [ "1548284409ad6d5583a05409ac78f458", "33a7b4f60646ef4d0b69298d9b2371a7", "b6bf59ce68a24a1ada4f165a51fbeb34", "36c062110eec376c4e6df97cd5409d44", "2a66fd8944ed02242c20ca291445eed7", "8359acd81e8b9e530a1a50cecef7689f", "f9afc880877274fcc4d4f28a264dda93", "dac581476ede4357205bc467420b4d4a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 76, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_da69250d5c8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "da69250d5c8d", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-45-16-27-57-43-51-10-17613-51764-65037-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 549, "first_seen": 1788442763, "last_seen": 1789958119, "transport": "q", "ja3_hash": "f182938fe9e632483552307808c94a07", "ja3_variant_count": 549, "ja3_variants": [ "f182938fe9e632483552307808c94a07", "f47c14f17c460d68c36234489568fc81", "bcc6982a8c6cdce31bd6fe4cea570c8d", "df760513ea544de86f50279fc4d55f48", "7d5e3fced154c7da5a1cbe8b79681bc4", "947e3b4637f382d7c790d71a82993574", "3bf5a727ca465d7334772b6b248484be", "e3dde7ad1bb98dbbf2ba8b47b8541f04", "12bef9d59535cf0ca94ec7367422ea66", "4c62c962a89b1ad9a43887546afa1706", "233df09d13bedc748408c8a22b4f75a9", "0fcc887cbf52babf256e2850fcbe9b9c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2424, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 425, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 747, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1260, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 145, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 206, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 781, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 59, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 PTST/260802.202201": 45, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 25, "PromptingBot/1.0.0": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 41, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15": 5, "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 PTST/260802.202201": 24, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 PTST/260802.202201": 90, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 118, "SEBot-WA": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (compatible; ev-crawler/1.0; +https://headline.com/web-crawler)": 26, "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 PTST/260802.202201": 41, "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 PTST/260802.202201": 22, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/152.0.0.0 Safari/537.36 PTST/260802.202201": 53 }, "ua_disagreement": true } }, { "hash": "q13d0312h3_55b375c5d22e_f60bf7ff48f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "f60bf7ff48f5", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,10-57-65037-51-17613-13-43-0-16-27-45-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1167, "first_seen": 1788441552, "last_seen": 1789960013, "transport": "q", "ja3_hash": "173e74e7f161925e3d42223daba7294b", "ja3_variant_count": 1167, "ja3_variants": [ "173e74e7f161925e3d42223daba7294b", "fcf4d82d29c7d4438c7d76f3a3a24f73", "3cbe4b5af6201fa2e7ed511d67dd8564", "11dc9b1ad60f4c29c05c5e85d644368f", "e90d3375703bcdbd67e96f7fa014c4ca", "9a22783a133b4dbd09baba7e7b9e12b6", "896239f67c6432acb287244c31ac4905", "a8a700ad24df93ef621030bd91b9fa87", "f25d134d0ab8f35cbc6f4902ef46175b", "a420e47c7cfc338458e6f9a6ff2837cb", "b09e5bd4af70a7b456642dd462dc0210", "47f8251c9cabeeb46d218189c17a2c35" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 8311, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1248, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 2312, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.4 Safari/537.36": 120, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 25374, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 223, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 87, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 465, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 454, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 37, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 81, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.163 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 82, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 66, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.7390.0 Safari/537.36": 1, "RootEvidence/1.0": 49, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.175 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.162 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2 }, "ua_disagreement": true } }, { "hash": "q13d0312h3_55b375c5d22e_f9238592c0a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "f9238592c0a5", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-0-43-34-10-16-13-5-28-45-51-57,29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 17, "first_seen": 1788446651, "last_seen": 1789928310, "transport": "q", "ja3_hash": "201c7e12e71737c93081c3d33b0a4dd8", "ja3_variant_count": 17, "ja3_variants": [ "201c7e12e71737c93081c3d33b0a4dd8", "e5530348ca7c982e6b026c14abc81b08", "3934f9d62eb3afc9a02f33725a9abf61", "dc4c1a0978cd75bd44b0c6005b34294d", "3239a6d7a7292f6f32d554e660d3ff98", "03b3dcb69cb6a762a4b032f866d8b97c", "29c00ac5816b683c6f957ad62734359f", "a608845f1214397894e540055b9e81ae", "1a0ab41f4ab23238d205d1f69b328604", "23855bdb1ffc9e3c79f8a56699468b1c", "45b2b875d9da8369fa9fbcf5c5db96bd", "2add0863f68c924c72ad2ea65e1406d6" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 1927, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 20, "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0": 28 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_0701f65b5a7a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "0701f65b5a7a", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,65037-0-51-45-57-17613-4832-43-10-16-27-13-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 20, "first_seen": 1788496344, "last_seen": 1788730483, "transport": "q", "ja3_hash": "253c6e65bfbe4af2497c6b6c0cf9a249", "ja3_variant_count": 20, "ja3_variants": [ "253c6e65bfbe4af2497c6b6c0cf9a249", "02cfccbea4087b0e1d59e5199c82e231", "7f4e788488ebceceb2826737748d90cd", "060b7156193eba8f2729eabe406247fe", "c278dc170ac3f23b87f08a35fb4ffc70", "06cd32e402e3b5d919764bbd9d82080b", "40e701f90f97164b75eae346488a9193", "9b8f9bee4e88b2aa78bf0be18d4d2c71", "f43823ef0a39c780fc59ae55d8ec9058", "cb51343aba6e838b043cb7bc2412405a", "5552dc60543646b205ed9930098b903d", "c154966dd6792370e4f8ec1cbd522633" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 36 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_53a8b841c459", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "53a8b841c459", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-0-43-57-34-10-51-45-5-13-27-28-16,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1789548613, "last_seen": 1789943510, "transport": "q", "ja3_hash": "5744eec112b4ac51da56eef526a32593", "ja3_variant_count": 5, "ja3_variants": [ "5744eec112b4ac51da56eef526a32593", "4fff7ae421469486ae00bedbc69dd6e2", "3a06e36442e8a4b63321985cce12f8dd", "d66e2015f043e46372e02ecea0976030", "89c9fcd69a587a8370d017a37956aad1" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 40, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 18, "Mozilla/5.0 (Android 16; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 28 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_6ca3580cd977", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "6ca3580cd977", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,57-43-65037-13-16-0-17613-27-45-51764-10-51-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 555, "first_seen": 1788454687, "last_seen": 1789923911, "transport": "q", "ja3_hash": "83f3733757d1f95cd418bd9777a93beb", "ja3_variant_count": 555, "ja3_variants": [ "83f3733757d1f95cd418bd9777a93beb", "060c95950111df7fb7afe922df892172", "28a957ae6db155a85affe1fbdd793d18", "66b0bf9c8e8772e107e2da681897e36d", "b5c7cf272b8c86e30b7bbb1ba773240a", "5c3a05ce98f3bb0edca852d1225ea2b1", "0d7756b2c357009b4fec602135b085e4", "8953a282a180eba32d0cd93ba32e7b89", "abffd1ec6c948045959d9aae922a892d", "64b59a95bb5ad442544f33769b78764e", "eb5245e1ecac74560203f65c3b4da015", "10aef55f8f7e1855b678032ce61d09e0" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 602, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1465, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 11153, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1441, "Mozilla/5.0 (compatible; ev-crawler/1.0; +https://headline.com/web-crawler)": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 294, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 56, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 51, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 28 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_824790d21c68", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "824790d21c68", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-43-0-57-13-27-51-10-16-34-45-5-28,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 60, "first_seen": 1788441818, "last_seen": 1789720073, "transport": "q", "ja3_hash": "d199480fc989a963908de8ae131be7f5", "ja3_variant_count": 60, "ja3_variants": [ "d199480fc989a963908de8ae131be7f5", "8e538f9151607f0ca5ace83767671d4d", "487c71bc132afe9c6bfc67b353d7d78e", "5cb03c41e06ad6b739d8c9937f0c0b32", "268afc709512e3b0484c4cd54d9147b8", "c6ded03a42c1f9380b9561f79604bf4a", "a3925b32f0ae144aaa328d5599ad2ea6", "939bfc449c587dc2690428e9b41e96d6", "167659d31bbcbe7de8403327ea440fe2", "3e96efb7252a77e8a07261cd12ad445a", "a0dd14058526dc477a17573a70f11344", "078b3c8dc9c44fe89c6ee65ece23eead" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 546, "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 89, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 23, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 39, "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 51, "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 200, "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0": 33, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 18, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0": 267, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 23, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 54, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 38, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0": 28, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 37, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 40, "Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 24, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0": 51, "Mozilla/5.0 (Android 15; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 23 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_b895d4c2708b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "b895d4c2708b", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-43-0-57-13-34-5-27-10-51-16-45-28,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789400948, "last_seen": 1789569244, "transport": "q", "ja3_hash": "9e0da737aef14932f1730c0013363308", "ja3_variant_count": 3, "ja3_variants": [ "9e0da737aef14932f1730c0013363308", "54844bf5884ac8adfc421690aced3612", "d8a66593f67258a047a3f6fb326d8d9a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 14 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_bc972749234a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "bc972749234a", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-13-43-57-4832-10-65037-17613-27-51-45-16-51764,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 28, "first_seen": 1788445301, "last_seen": 1789946155, "transport": "q", "ja3_hash": "6a6ca125b25dec1b198117f918f29bed", "ja3_variant_count": 28, "ja3_variants": [ "6a6ca125b25dec1b198117f918f29bed", "d8942e43ffad175e9b7ccf38be210514", "12d55b1cbd89555e0134c40bdbbeece7", "1e5f3e182d305b47ddf4769649b457f4", "f07335c8bd5c6dac6b7fc7f27c8ed213", "afa72ac574decd9ecee944237c84d10d", "9152b430a14f5187adf7de96bbc89cb0", "8d642f1820517f0bebc00321555b7e28", "897b2263be30d0f1a5a293e6ced82724", "d3c4487c5ef78fe80c064650e2fcfe1e", "10f0251e23323aa18c930bae85ccca10", "4b6880acf6de085aa2e0801a19d72d6d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 89, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 48, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 158, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 108, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2159.1780 Safari/537.36": 24 }, "ua_disagreement": true } }, { "hash": "q13d0313h3_55b375c5d22e_bea67a3397ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "bea67a3397ee", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-0-43-57-27-34-5-13-51-28-45-16-10,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789051696, "last_seen": 1789396793, "transport": "q", "ja3_hash": "92be168b2b749bbcddaeb7789d403da6", "ja3_variant_count": 4, "ja3_variants": [ "92be168b2b749bbcddaeb7789d403da6", "b141832ba9c6f84a8d34b1a229c5f174", "4a5d6609e481058da9ba363272945d26", "bc8edbb49ffe9bf28b4030f6409db086" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 131 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_e08d512f6d51", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "e08d512f6d51", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65281-13-0-28-23-16-51-10-34-43-5-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 14, "first_seen": 1789762413, "last_seen": 1789954315, "transport": "q", "ja3_hash": "2d7c565fb4b585a722176c7ed42d79bd", "ja3_variant_count": 14, "ja3_variants": [ "2d7c565fb4b585a722176c7ed42d79bd", "0550a1098e4944d3fa448c2eead8bce6", "9d300e377cc98c74a4b13bd6ad6f7ea4", "0c965bddf6a6c592ff2af5561bbd2b83", "d1fb7b5faa5917774d04ebcfd347fb53", "80fff54b8b4950063041c661a343e5a6", "42a3b5d42be8815f85f14c9df2711f96", "af98a172935c7c98cbfa3fea312c0176", "127ec8dacb40e8c419c90a670033921f", "40d1e9b6128019d51970c09f2ff0932b", "be2ca4339ea240a600fff8b173399680", "4e0bbc17cd92bc2efe9dd097d6ebca96" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 101 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_5e8caae252b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "5e8caae252b6", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65281-16-10-45-43-13-0-28-34-23-51-5-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 127, "first_seen": 1788446653, "last_seen": 1789903847, "transport": "q", "ja3_hash": "f573c91e5936a9dd02dfb49bda026d3e", "ja3_variant_count": 127, "ja3_variants": [ "f573c91e5936a9dd02dfb49bda026d3e", "8c01441fa7eaa56643e913d071702d0a", "b0cdb00df52e3ad120a32e42493c563a", "276ca8c143c9f150876b55c1245db92c", "df092b6a1f314e97bd3846a6d20fcefd", "e355955a4d33481dae39ee790617dad3", "b5bf93651a55471d2da45f7b50ea78c6", "288e073f516c5fb215835d38c1873cfd", "c4cc0f6d67c890a8f04e0a6139a22cc5", "42547d5c6891077ae6e3d23103fe7f42", "d0890c5bc2a9b2c7c74a9254e8802ff8", "3bcdebd306a4f840549f2bc9ccca8e45" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 3127 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_7dbaeef5f02a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "7dbaeef5f02a", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,65037-0-27-17613-45-10-4832-16-13-51764-43-51-57-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1788811484, "last_seen": 1789686173, "transport": "q", "ja3_hash": "3a6d7bcf30b51b87943694b72822c25d", "ja3_variant_count": 6, "ja3_variants": [ "3a6d7bcf30b51b87943694b72822c25d", "4222021a5fb88a22590dd16ab4c964b0", "3b1ce8c435514a1053011925abe796c1", "65e1683ac75288d08b840fa3f01d91cb", "d6545d96f3f443a924b0afb60901edb5", "f6d3c931e8614e9858709b843b98cef4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_911ef5bc091a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "911ef5bc091a", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,0-23-65281-10-16-5-34-51-43-13-45-28-57-21,29-23-24-25-256-257-258-259-260,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788638697, "last_seen": 1788960067, "transport": "q", "ja3_hash": "b719940c5ab9a3373cb4475d8143ff88", "ja3_variant_count": 1, "ja3_variants": [ "b719940c5ab9a3373cb4475d8143ff88" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0": 38, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:109.0) Gecko/20100101 Firefox/115.0": 7 }, "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_2473069875c4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "2473069875c4", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,23-51-16-43-27-34-65281-45-13-10-0-5-28-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 194, "first_seen": 1788441818, "last_seen": 1789927810, "transport": "q", "ja3_hash": "01b6cf7e839e1eb1281fb0cfc5acc2b5", "ja3_variant_count": 194, "ja3_variants": [ "01b6cf7e839e1eb1281fb0cfc5acc2b5", "a782c8234a3f762958d154dc5a61627e", "91efbb29a06ec9924bc34b73b947e126", "900eda0c0d94b10959465161b70ff35f", "d0f3568ec78034c72bb6a60bf089ea72", "9f0502a564893a78f3f2c988ccbe82fe", "99768a12ebaace07753d8810d1a37f32", "6305b74b202d33e4f834b015afb31c85", "c09972b0251b0e77a070524b9fa29492", "3c7fac705d4a2b0bef69aae08232e6e6", "8da0973bfd0e67070130bef9f86286f2", "19f9e56c7f625a565e113ae7edbc63cb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0": 135, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 653, "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 230, "Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 7, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 1170, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 39, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0": 66, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 80, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 20, "Mozilla/5.0 (Android 16; Mobile; rv:155.0) Gecko/155.0 Firefox/155.0": 1, "Mozilla/5.0 (Android 15; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 2, "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 19, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 5, "Mozilla/5.0 (Android 17; Mobile; rv:155.0) Gecko/155.0 Firefox/155.0": 19 }, "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_626768ae0108", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "626768ae0108", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,5-16-51-13-65281-23-45-28-34-10-43-0-27-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 81, "first_seen": 1788556935, "last_seen": 1789889177, "transport": "q", "ja3_hash": "f206e93653b41c249e90cd3f8e65f93e", "ja3_variant_count": 81, "ja3_variants": [ "f206e93653b41c249e90cd3f8e65f93e", "88ec4996141bb962427ba9dfd68ff34e", "a43cf4095912adbe25661f314e1b48f3", "1a3eeb9006037e179b7d862c0a467202", "5acf9cc30465a2bfc5f5e46d67ce1d31", "c8be5fc688a67a3bef241e608e7fab6f", "11b16d520a8278dbaa91ae56514cddb7", "bf64b23a2c0316e56644cb559ee76ce1", "b08a166f8d2911d4ffa7911f8d404e7b", "496bb7dd7f5342a34d283fac1a3795df", "b002729e83e13ab0f908fe35b29316a9", "8f030035cdde0e6bda577d96f3ff1b72" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 232, "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 8, "Mozilla/5.0 (Android 14; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 25 }, "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_6af405fcf435", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "6af405fcf435", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,23-27-5-51-65281-10-13-34-16-0-28-43-45-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 93, "first_seen": 1789051696, "last_seen": 1789399144, "transport": "q", "ja3_hash": "0001b8dcb87727fddf4842be6d6d01ce", "ja3_variant_count": 93, "ja3_variants": [ "0001b8dcb87727fddf4842be6d6d01ce", "95fe13b696175ad3d94164cdfb658c3e", "8bbd71481cc68d9fba78f889acbff397", "5a6b94b344c8ea45dae6d92cdda3c005", "e984b8335c92ffd7f3c49e30c7314e98", "6ed551a5d22fe64bf72161f984a19ec6", "a036e1b2e337ad9b8c69aaa32998eb63", "2cfcc47571a482e88b42cfc4f6b423a2", "a7b2a6957a7d5fc7ef2e43a9fa765a8a", "73d3714b612ca33d74d18969c8268ea5", "159ccf9f14570a1a2bc56a7a61af6f8c", "74730d486900fb9e239d0b7cbc0501e4" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 133 }, "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_725e25c74efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "725e25c74efd", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,13-23-16-65281-34-43-10-45-28-27-51-5-0-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789472429, "last_seen": 1789652361, "transport": "q", "ja3_hash": "8b52796f45070fc15ab3952715a513bc", "ja3_variant_count": 2, "ja3_variants": [ "8b52796f45070fc15ab3952715a513bc", "af4243cffdd3f4cade734ab99dda1439" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 8 }, "ua_disagreement": false } }, { "hash": "q13d0413h3_16476d049b0b_745ab6f97f32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0413h3", "b": "16476d049b0b", "c": "745ab6f97f32", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865-255,0-11-10-16-22-23-49-13-43-45-51-57-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3220, "first_seen": 1787442715, "last_seen": 1789951578, "transport": "q", "ja3_hash": "42125b8d3d7a27886a9600b9a38e8559", "ja3_variant_count": 1, "ja3_variants": [ "42125b8d3d7a27886a9600b9a38e8559" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 2797, "curl/8.18.0-DEV": 126, "Go-http-client/2.0": 3 }, "ua_disagreement": true } }, { "hash": "t12d130800_f57a46bbacb6_da269a3f638a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d130800", "b": "f57a46bbacb6", "c": "da269a3f638a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 19, "first_seen": 1787471566, "last_seen": 1789930744, "transport": "t", "ja3_hash": "d8f17d41fba1d5b9f88fff3a2bf0df6c", "ja3_variant_count": 1, "ja3_variants": [ "d8f17d41fba1d5b9f88fff3a2bf0df6c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.5250.48 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.5978.152 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.5298.47 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1310h2_8b80da21ef18_6c199d4894a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d1310h2", "b": "8b80da21ef18", "c": "6c199d4894a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-11-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 37, "first_seen": 1787772528, "last_seen": 1789680883, "transport": "t", "ja3_hash": "bc6c386f480ee97b9d9e52d472b772d8", "ja3_variant_count": 1, "ja3_variants": [ "bc6c386f480ee97b9d9e52d472b772d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1310h2_f57a46bbacb6_fdfedcf8c354", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1310h2", "b": "f57a46bbacb6", "c": "fdfedcf8c354", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-52393-49199-52392-49162-49161-49172-49171,0-23-65281-10-11-16-5-13-18-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789355907, "last_seen": 1789356160, "transport": "t", "ja3_hash": "9223f20a70d5753741a78e5b06e9648c", "ja3_variant_count": 1, "ja3_variants": [ "9223f20a70d5753741a78e5b06e9648c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.4 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.4 facebookexternalhit/1.1 Facebot Twitterbot/1.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1311h2_8b80da21ef18_bc4a777cfdc5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d1311h2", "b": "8b80da21ef18", "c": "bc4a777cfdc5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-30032-11-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 30032, "name": "30032 (0x7550)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789405273, "last_seen": 1789817686, "transport": "t", "ja3_hash": "94c485bca29d5392be53f2b8cf7f4304", "ja3_variant_count": 1, "ja3_variants": [ "94c485bca29d5392be53f2b8cf7f4304" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150200_8daaf6152771_1b12d417929b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150200", "b": "8daaf6152771", "c": "1b12d417929b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 8, "first_seen": 1788147671, "last_seen": 1789867946, "transport": "t", "ja3_hash": "ce3c89f378314f9ab654c09f0b60df1e", "ja3_variant_count": 1, "ja3_variants": [ "ce3c89f378314f9ab654c09f0b60df1e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_1037bdebdd62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "1037bdebdd62", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788620854, "last_seen": 1788620854, "transport": "t", "ja3_hash": "ba422d220df57d21232e88ed18a71df0", "ja3_variant_count": 1, "ja3_variants": [ "ba422d220df57d21232e88ed18a71df0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_27e267d15e11", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "27e267d15e11", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788836151, "last_seen": 1789701481, "transport": "t", "ja3_hash": "f66da1a354d437f56843f5892eddc4e3", "ja3_variant_count": 2, "ja3_variants": [ "f66da1a354d437f56843f5892eddc4e3", "1b4ae136bf5dda8ede24a09db9f07c95" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_2968ded16f02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "2968ded16f02", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788780988, "last_seen": 1788780988, "transport": "t", "ja3_hash": "c0b2779eb8abfe8680a2fa2a6282eb93", "ja3_variant_count": 1, "ja3_variants": [ "c0b2779eb8abfe8680a2fa2a6282eb93" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_baf0a4827efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "baf0a4827efd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788965194, "last_seen": 1788965194, "transport": "t", "ja3_hash": "2764fcba8d3ecd74cc33de5ee5e3af0e", "ja3_variant_count": 1, "ja3_variants": [ "2764fcba8d3ecd74cc33de5ee5e3af0e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_c988acfa4f19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "c988acfa4f19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789646820, "last_seen": 1789646820, "transport": "t", "ja3_hash": "50f106f4a102447a2efa16bfbd8a8020", "ja3_variant_count": 1, "ja3_variants": [ "50f106f4a102447a2efa16bfbd8a8020" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 3 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_cb0c27a6e9f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "cb0c27a6e9f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789829301, "last_seen": 1789829301, "transport": "t", "ja3_hash": "b8a7dbf836dd5abfd314c15d4023e35d", "ja3_variant_count": 1, "ja3_variants": [ "b8a7dbf836dd5abfd314c15d4023e35d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_ef9d29fa14b0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "ef9d29fa14b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1787827871, "last_seen": 1789888082, "transport": "t", "ja3_hash": "64649f6616902001c5ac6b8b9f3cba14", "ja3_variant_count": 2, "ja3_variants": [ "64649f6616902001c5ac6b8b9f3cba14", "b60e990260b58b75280a622a3e6196b5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12d1503h2_8daaf6152771_baf0a4827efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (baf0a4827efd) with 2 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d1503h2", "b": "8daaf6152771", "c": "baf0a4827efd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788552180, "last_seen": 1788552180, "transport": "t", "ja3_hash": "bd8ab30ac2691412f699cecb6a9b15ac", "ja3_variant_count": 1, "ja3_variants": [ "bd8ab30ac2691412f699cecb6a9b15ac" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d150400_8daaf6152771_1afacb3113b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "1afacb3113b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789776187, "last_seen": 1789776187, "transport": "t", "ja3_hash": "d604dc4f0e3ff9eaa09df2506c3382e9", "ja3_variant_count": 1, "ja3_variants": [ "d604dc4f0e3ff9eaa09df2506c3382e9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_24be3a94643d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "24be3a94643d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788824799, "last_seen": 1788824799, "transport": "t", "ja3_hash": "888c634bb1c0b4f0306013f510d7e277", "ja3_variant_count": 1, "ja3_variants": [ "888c634bb1c0b4f0306013f510d7e277" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_2d266b4c4422", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "2d266b4c4422", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788788511, "last_seen": 1788788511, "transport": "t", "ja3_hash": "f7761981a5691fa13a81fb416dfa4cef", "ja3_variant_count": 1, "ja3_variants": [ "f7761981a5691fa13a81fb416dfa4cef" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_55a0f8a19a8e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "55a0f8a19a8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788791355, "last_seen": 1788791355, "transport": "t", "ja3_hash": "a734d22871183ae97839df0eb98a710f", "ja3_variant_count": 1, "ja3_variants": [ "a734d22871183ae97839df0eb98a710f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_5607da189e96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "5607da189e96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789224357, "last_seen": 1789224357, "transport": "t", "ja3_hash": "1d7ed160de91d8ea379f670d89b63ed5", "ja3_variant_count": 1, "ja3_variants": [ "1d7ed160de91d8ea379f670d89b63ed5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_6228070e188e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "6228070e188e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789870188, "last_seen": 1789870188, "transport": "t", "ja3_hash": "632b789e10d0256f10ad45c71d2e97f3", "ja3_variant_count": 1, "ja3_variants": [ "632b789e10d0256f10ad45c71d2e97f3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_9f1d7398a82c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "9f1d7398a82c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788763486, "last_seen": 1788763486, "transport": "t", "ja3_hash": "8d66bb52100efc87be8494a7ff952da4", "ja3_variant_count": 1, "ja3_variants": [ "8d66bb52100efc87be8494a7ff952da4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_b393474956ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "b393474956ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788973917, "last_seen": 1788973917, "transport": "t", "ja3_hash": "47636259c8e34a1451d78b583d633d85", "ja3_variant_count": 1, "ja3_variants": [ "47636259c8e34a1451d78b583d633d85" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_bdc91fe8a595", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "bdc91fe8a595", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788790797, "last_seen": 1789776063, "transport": "t", "ja3_hash": "75103551cf572caf25a00a7c6ed9650d", "ja3_variant_count": 2, "ja3_variants": [ "75103551cf572caf25a00a7c6ed9650d", "69a9b21fd44593456306a63b6c599686" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_f359bec8aaa4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "f359bec8aaa4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788515793, "last_seen": 1788989497, "transport": "t", "ja3_hash": "d41915d1c528be97702a9e76df6a805d", "ja3_variant_count": 1, "ja3_variants": [ "d41915d1c528be97702a9e76df6a805d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_fe8352abbea0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "fe8352abbea0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788833261, "last_seen": 1788833261, "transport": "t", "ja3_hash": "99b464e16aec80d69ec528d8afaa49b0", "ja3_variant_count": 1, "ja3_variants": [ "99b464e16aec80d69ec528d8afaa49b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1504ht_8daaf6152771_91f3c070d38b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1504ht", "b": "8daaf6152771", "c": "91f3c070d38b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788842377, "last_seen": 1788842377, "transport": "t", "ja3_hash": "b3abd1ec1a11cfd0d98dc2b82a8a4c20", "ja3_variant_count": 1, "ja3_variants": [ "b3abd1ec1a11cfd0d98dc2b82a8a4c20" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_0a4f5daca207", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "0a4f5daca207", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-0-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789192703, "last_seen": 1789192703, "transport": "t", "ja3_hash": "0f2a4d9dbd16c812f4877b279fa83e3d", "ja3_variant_count": 1, "ja3_variants": [ "0f2a4d9dbd16c812f4877b279fa83e3d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_14b11f3ff465", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "14b11f3ff465", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-0-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789054650, "last_seen": 1789054650, "transport": "t", "ja3_hash": "3e689b4ba65a8e0df0ebb877279e6cad", "ja3_variant_count": 1, "ja3_variants": [ "3e689b4ba65a8e0df0ebb877279e6cad" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 5 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_2723e6fcfe73", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "2723e6fcfe73", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-0-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788567606, "last_seen": 1788567606, "transport": "t", "ja3_hash": "b5ee3dbf11a44ed29a0dd4a2dd0e51cb", "ja3_variant_count": 1, "ja3_variants": [ "b5ee3dbf11a44ed29a0dd4a2dd0e51cb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_49e314b495ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "49e314b495ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-5-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789457568, "last_seen": 1789457568, "transport": "t", "ja3_hash": "7e7c5a62cac942be51216f743a2ff71b", "ja3_variant_count": 1, "ja3_variants": [ "7e7c5a62cac942be51216f743a2ff71b" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_577fd7d1a7ef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "577fd7d1a7ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-17613-65281-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789928050, "last_seen": 1789928050, "transport": "t", "ja3_hash": "d5d88e62ad09f6efb3661036d6378abd", "ja3_variant_count": 1, "ja3_variants": [ "d5d88e62ad09f6efb3661036d6378abd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.2213.67 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_9120ef33c320", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "9120ef33c320", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-65281-0-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789390441, "last_seen": 1789390441, "transport": "t", "ja3_hash": "c31515a9049f8c12a2611c64f5025b00", "ja3_variant_count": 1, "ja3_variants": [ "c31515a9049f8c12a2611c64f5025b00" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_997359a1bd4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "997359a1bd4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-18-17613-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789702111, "last_seen": 1789702111, "transport": "t", "ja3_hash": "5442487a08e92db2d4d48d163a1c7941", "ja3_variant_count": 1, "ja3_variants": [ "5442487a08e92db2d4d48d163a1c7941" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_9a4d5754f06a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "9a4d5754f06a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-65037-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788990753, "last_seen": 1788990753, "transport": "t", "ja3_hash": "0ac8780662ae4ba261c530ac53db4049", "ja3_variant_count": 1, "ja3_variants": [ "0ac8780662ae4ba261c530ac53db4049" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_a5d7afc45084", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "a5d7afc45084", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-0-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788582215, "last_seen": 1788582215, "transport": "t", "ja3_hash": "9dcb3fa8929bd767022ec02f0ab2ce99", "ja3_variant_count": 1, "ja3_variants": [ "9dcb3fa8929bd767022ec02f0ab2ce99" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_ac1d0aa0e9e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "ac1d0aa0e9e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789912787, "last_seen": 1789912787, "transport": "t", "ja3_hash": "b586484ffad3ce307942f999fb9c5671", "ja3_variant_count": 1, "ja3_variants": [ "b586484ffad3ce307942f999fb9c5671" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 9 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_b5b2d70ae0d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "b5b2d70ae0d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789460113, "last_seen": 1789460113, "transport": "t", "ja3_hash": "ff23304cf1fc51c6c0097f6c597adca4", "ja3_variant_count": 1, "ja3_variants": [ "ff23304cf1fc51c6c0097f6c597adca4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 18 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_ba7e4154582f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "ba7e4154582f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788768988, "last_seen": 1788768988, "transport": "t", "ja3_hash": "cdc0839291fb40c95a2569ade9d3a80e", "ja3_variant_count": 1, "ja3_variants": [ "cdc0839291fb40c95a2569ade9d3a80e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_e9554f16cb8b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "e9554f16cb8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-13-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789632514, "last_seen": 1789632514, "transport": "t", "ja3_hash": "0fad0ca15ecdcbc053c540e8a2049298", "ja3_variant_count": 1, "ja3_variants": [ "0fad0ca15ecdcbc053c540e8a2049298" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_e9a0d0082567", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "e9a0d0082567", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-51-0-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788739265, "last_seen": 1788739265, "transport": "t", "ja3_hash": "05dba648f6a24787a9ec8ece3a788795", "ja3_variant_count": 1, "ja3_variants": [ "05dba648f6a24787a9ec8ece3a788795" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_eb679901f2d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "eb679901f2d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-10-0-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788799078, "last_seen": 1788799078, "transport": "t", "ja3_hash": "45de6a4258047467ae112635211e49e0", "ja3_variant_count": 1, "ja3_variants": [ "45de6a4258047467ae112635211e49e0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_3f09f704fcf3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "3f09f704fcf3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788508429, "last_seen": 1788508429, "transport": "t", "ja3_hash": "bef765ee5f616373a3f840c4164d6d54", "ja3_variant_count": 1, "ja3_variants": [ "bef765ee5f616373a3f840c4164d6d54" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_c04ed08e4e34", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "c04ed08e4e34", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-45-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789479901, "last_seen": 1789479901, "transport": "t", "ja3_hash": "3175317ec9ffcac00ca85ccea360fd99", "ja3_variant_count": 1, "ja3_variants": [ "3175317ec9ffcac00ca85ccea360fd99" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_ccfaee51b21a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "ccfaee51b21a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-16-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788723995, "last_seen": 1788723995, "transport": "t", "ja3_hash": "a450d26e628e7b4abb97b06b2b2af1b1", "ja3_variant_count": 1, "ja3_variants": [ "a450d26e628e7b4abb97b06b2b2af1b1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 25 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_d4e7110f08a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "d4e7110f08a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789591782, "last_seen": 1789591782, "transport": "t", "ja3_hash": "1764491cedc065ae351655249b01e441", "ja3_variant_count": 1, "ja3_variants": [ "1764491cedc065ae351655249b01e441" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1505ht_8daaf6152771_38867ffa8acc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505ht", "b": "8daaf6152771", "c": "38867ffa8acc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-0-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788884506, "last_seen": 1788884506, "transport": "t", "ja3_hash": "848bf6ec70689163d4f23a8bc4b5cc79", "ja3_variant_count": 1, "ja3_variants": [ "848bf6ec70689163d4f23a8bc4b5cc79" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505ht_8daaf6152771_88ea688c6e9e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505ht", "b": "8daaf6152771", "c": "88ea688c6e9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788870664, "last_seen": 1788870664, "transport": "t", "ja3_hash": "2bfd27280b839d4c9bb1ff65969856e1", "ja3_variant_count": 1, "ja3_variants": [ "2bfd27280b839d4c9bb1ff65969856e1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_0d14bc4f6f25", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "0d14bc4f6f25", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-65037-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789811747, "last_seen": 1789811747, "transport": "t", "ja3_hash": "a5ee3b99d5fa719d03cd63246e711f90", "ja3_variant_count": 1, "ja3_variants": [ "a5ee3b99d5fa719d03cd63246e711f90" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 4 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_23be13b33bcb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "23be13b33bcb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-0-45-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789690381, "last_seen": 1789690381, "transport": "t", "ja3_hash": "6828276b535bc596de1b9a05dff46182", "ja3_variant_count": 1, "ja3_variants": [ "6828276b535bc596de1b9a05dff46182" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_376d32bdcd8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "376d32bdcd8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-18-0-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788796288, "last_seen": 1788796288, "transport": "t", "ja3_hash": "6515ef9da20b9094d6a693cd99ed3ec7", "ja3_variant_count": 1, "ja3_variants": [ "6515ef9da20b9094d6a693cd99ed3ec7" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_43945de3600f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "43945de3600f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-18-13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789192494, "last_seen": 1789192494, "transport": "t", "ja3_hash": "29347974130f21201ef2b44706044be1", "ja3_variant_count": 1, "ja3_variants": [ "29347974130f21201ef2b44706044be1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 40 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_46bbdc7f7577", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "46bbdc7f7577", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-0-13-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789675757, "last_seen": 1789675757, "transport": "t", "ja3_hash": "586f0532a1039afbe16995e7fac33d29", "ja3_variant_count": 1, "ja3_variants": [ "586f0532a1039afbe16995e7fac33d29" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_4836e47f79ed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "4836e47f79ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-17513-35-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788990260, "last_seen": 1788990260, "transport": "t", "ja3_hash": "adea50ceca72ff001ecb8ea0f3370ddf", "ja3_variant_count": 1, "ja3_variants": [ "adea50ceca72ff001ecb8ea0f3370ddf" ], "user_agents": { "Mozilla/5.0 (Linux; Android 8.0.0; SM-J330G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36 EdgA/114.0.1823.74": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_5dc507bef692", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "5dc507bef692", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-51-5-17613-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788552762, "last_seen": 1788552762, "transport": "t", "ja3_hash": "ff2306865ea5d127325ba5b88a9940bb", "ja3_variant_count": 1, "ja3_variants": [ "ff2306865ea5d127325ba5b88a9940bb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_700a63e53eaa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "700a63e53eaa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-23-13-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788838925, "last_seen": 1788838925, "transport": "t", "ja3_hash": "3d581796eb10f74970b9012f647c1fc2", "ja3_variant_count": 1, "ja3_variants": [ "3d581796eb10f74970b9012f647c1fc2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_7195a055c943", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "7195a055c943", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-65037-23-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789697953, "last_seen": 1789697953, "transport": "t", "ja3_hash": "6e9dacd9c0a42d971920f76b5eaf06a5", "ja3_variant_count": 1, "ja3_variants": [ "6e9dacd9c0a42d971920f76b5eaf06a5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_727cc6ff3ce1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "727cc6ff3ce1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-10-27-0-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789462100, "last_seen": 1789462100, "transport": "t", "ja3_hash": "88698f3e5c88bdd5ae294e253034f54d", "ja3_variant_count": 1, "ja3_variants": [ "88698f3e5c88bdd5ae294e253034f54d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_8d47efcc3b6b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "8d47efcc3b6b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-51-45-0-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024341, "last_seen": 1789024341, "transport": "t", "ja3_hash": "0fe392f76712ed000578d97840249f7f", "ja3_variant_count": 1, "ja3_variants": [ "0fe392f76712ed000578d97840249f7f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_9195cb421bcb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "9195cb421bcb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-35-11-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789078368, "last_seen": 1789078368, "transport": "t", "ja3_hash": "630ad984c1236b7cbcd94b06353e204a", "ja3_variant_count": 1, "ja3_variants": [ "630ad984c1236b7cbcd94b06353e204a" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_91dd0ebbcbdd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "91dd0ebbcbdd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-35-17613-0-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789870127, "last_seen": 1789870127, "transport": "t", "ja3_hash": "56acc9aa784dd12c9426c087c41b83b5", "ja3_variant_count": 1, "ja3_variants": [ "56acc9aa784dd12c9426c087c41b83b5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_a900aa46d07b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "a900aa46d07b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-11-0-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789163323, "last_seen": 1789891745, "transport": "t", "ja3_hash": "75f5fdfc6b3a1c2aff4d04166fdc3b0d", "ja3_variant_count": 2, "ja3_variants": [ "75f5fdfc6b3a1c2aff4d04166fdc3b0d", "25d9051ec4b0e46e198c2beb90f6a40b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_a95800acf117", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "a95800acf117", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-17613-13-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789696455, "last_seen": 1789696455, "transport": "t", "ja3_hash": "0375f3ab06713432eabc8497470c2e7d", "ja3_variant_count": 1, "ja3_variants": [ "0375f3ab06713432eabc8497470c2e7d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_d12977060b85", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "d12977060b85", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51764-0-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789749420, "last_seen": 1789749420, "transport": "t", "ja3_hash": "5d8660ee76362b948b0139ed588c8a8a", "ja3_variant_count": 1, "ja3_variants": [ "5d8660ee76362b948b0139ed588c8a8a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_eb18c8aeae74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "eb18c8aeae74", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-0-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788659386, "last_seen": 1788659386, "transport": "t", "ja3_hash": "3361ec416f737269143ab8e181f30a49", "ja3_variant_count": 1, "ja3_variants": [ "3361ec416f737269143ab8e181f30a49" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_ec508e4ddd68", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "ec508e4ddd68", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-0-17613-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788800072, "last_seen": 1788800072, "transport": "t", "ja3_hash": "2087d27dde3dcf324a101d426e48f03a", "ja3_variant_count": 1, "ja3_variants": [ "2087d27dde3dcf324a101d426e48f03a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_f6c445a546ae", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "f6c445a546ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-35-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789696521, "last_seen": 1789696521, "transport": "t", "ja3_hash": "cf1d02ee053c2af414574151c5703fec", "ja3_variant_count": 1, "ja3_variants": [ "cf1d02ee053c2af414574151c5703fec" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_3587192c7715", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "3587192c7715", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-18-65281-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789679735, "last_seen": 1789679735, "transport": "t", "ja3_hash": "91e39face1ca929f3c5e9d2999d57092", "ja3_variant_count": 1, "ja3_variants": [ "91e39face1ca929f3c5e9d2999d57092" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_7d1e362cf368", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "7d1e362cf368", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-5-13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789651684, "last_seen": 1789651684, "transport": "t", "ja3_hash": "3be45d555294519c98ef17166a5415ba", "ja3_variant_count": 1, "ja3_variants": [ "3be45d555294519c98ef17166a5415ba" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_c68933beeb92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "c68933beeb92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,16-45-0-17613-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789843148, "last_seen": 1789843148, "transport": "t", "ja3_hash": "f3404f5e8340b80c6e0d1960f439947b", "ja3_variant_count": 1, "ja3_variants": [ "f3404f5e8340b80c6e0d1960f439947b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_fadabebf0399", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "fadabebf0399", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-17613-18-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788770687, "last_seen": 1788770687, "transport": "t", "ja3_hash": "0834d1258bf1b510f21cf35d465b8f23", "ja3_variant_count": 1, "ja3_variants": [ "0834d1258bf1b510f21cf35d465b8f23" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506ht_8daaf6152771_5676db62a180", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506ht", "b": "8daaf6152771", "c": "5676db62a180", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-51-16-0-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789965258, "last_seen": 1789965258, "transport": "t", "ja3_hash": "4a781d911b512bbfc9d56a3fd7395f52", "ja3_variant_count": 1, "ja3_variants": [ "4a781d911b512bbfc9d56a3fd7395f52" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506ht_8daaf6152771_bbe37b841a09", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506ht", "b": "8daaf6152771", "c": "bbe37b841a09", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-16-23-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788814522, "last_seen": 1788814522, "transport": "t", "ja3_hash": "ac7a061d1d55f9ef6914d21e44ce557b", "ja3_variant_count": 1, "ja3_variants": [ "ac7a061d1d55f9ef6914d21e44ce557b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506ht_8daaf6152771_c8f838442749", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506ht", "b": "8daaf6152771", "c": "c8f838442749", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-65037-16-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789631250, "last_seen": 1789631250, "transport": "t", "ja3_hash": "00ed51a4ba84452fec64d56f7f166088", "ja3_variant_count": 1, "ja3_variants": [ "00ed51a4ba84452fec64d56f7f166088" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_093e25f1d069", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "093e25f1d069", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-45-65037-11-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788860439, "last_seen": 1788860439, "transport": "t", "ja3_hash": "2327a888f4cf3c7ba520c975c2a6b93c", "ja3_variant_count": 1, "ja3_variants": [ "2327a888f4cf3c7ba520c975c2a6b93c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_260fa694077d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "260fa694077d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-5-0-10-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788899823, "last_seen": 1788899823, "transport": "t", "ja3_hash": "2e199067cec85c54750b35536b6ab30b", "ja3_variant_count": 1, "ja3_variants": [ "2e199067cec85c54750b35536b6ab30b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_4680b51460e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "4680b51460e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-0-35-17613-11-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788786722, "last_seen": 1788786722, "transport": "t", "ja3_hash": "21511692f7f94d0d46b64aac7a26c09c", "ja3_variant_count": 1, "ja3_variants": [ "21511692f7f94d0d46b64aac7a26c09c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_49aace187330", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "49aace187330", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-0-65037-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789686920, "last_seen": 1789686920, "transport": "t", "ja3_hash": "5868a88e4bf594d9147f01b2fed62357", "ja3_variant_count": 1, "ja3_variants": [ "5868a88e4bf594d9147f01b2fed62357" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_502d61787738", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "502d61787738", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-23-35-0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788961102, "last_seen": 1788961102, "transport": "t", "ja3_hash": "b77021b04cf5b250bd196b0089b3cf13", "ja3_variant_count": 1, "ja3_variants": [ "b77021b04cf5b250bd196b0089b3cf13" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_564ef60b0578", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "564ef60b0578", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-0-45-5-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789028208, "last_seen": 1789028208, "transport": "t", "ja3_hash": "6ef12ae1bd6584f14ac4ab4e35ee1a26", "ja3_variant_count": 1, "ja3_variants": [ "6ef12ae1bd6584f14ac4ab4e35ee1a26" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_596a89a2c4a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "596a89a2c4a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-51764-45-27-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789711539, "last_seen": 1789711539, "transport": "t", "ja3_hash": "55278dadc49e6af7f0fab456df564626", "ja3_variant_count": 1, "ja3_variants": [ "55278dadc49e6af7f0fab456df564626" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_61b783a2551e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "61b783a2551e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-17613-5-0-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788932420, "last_seen": 1788932420, "transport": "t", "ja3_hash": "96c1b0fea7d5913c1c064feab28e745e", "ja3_variant_count": 1, "ja3_variants": [ "96c1b0fea7d5913c1c064feab28e745e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_756b94b069b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "756b94b069b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-10-45-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788784614, "last_seen": 1788784614, "transport": "t", "ja3_hash": "478da8c982d2170b9efac950908a311f", "ja3_variant_count": 1, "ja3_variants": [ "478da8c982d2170b9efac950908a311f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_806e1127c62c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "806e1127c62c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-0-5-27-17613-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789131935, "last_seen": 1789131935, "transport": "t", "ja3_hash": "330721dc587bfb6106452142e92db1a7", "ja3_variant_count": 1, "ja3_variants": [ "330721dc587bfb6106452142e92db1a7" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_9f5af1b6fc8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "9f5af1b6fc8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-13-10-0-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788882163, "last_seen": 1788882163, "transport": "t", "ja3_hash": "404a9c15c19debcefc712694aa6748ab", "ja3_variant_count": 1, "ja3_variants": [ "404a9c15c19debcefc712694aa6748ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_af2808cf11fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "af2808cf11fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-51-0-11-45-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788839902, "last_seen": 1788839902, "transport": "t", "ja3_hash": "d0849de6bf6e5fa8a14b21a0ebad7fca", "ja3_variant_count": 1, "ja3_variants": [ "d0849de6bf6e5fa8a14b21a0ebad7fca" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_b15fef1fd057", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "b15fef1fd057", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-45-27-51764-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789656406, "last_seen": 1789656406, "transport": "t", "ja3_hash": "0ea2510d38043440452039774ed7812a", "ja3_variant_count": 1, "ja3_variants": [ "0ea2510d38043440452039774ed7812a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_bd6bcb70713c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "bd6bcb70713c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-18-10-27-17613-35,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788634786, "last_seen": 1788634786, "transport": "t", "ja3_hash": "d48421a0e38edc8f9f5a5974836f2b26", "ja3_variant_count": 1, "ja3_variants": [ "d48421a0e38edc8f9f5a5974836f2b26" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_c330208a4152", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "c330208a4152", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-10-27-65037-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789457567, "last_seen": 1789457567, "transport": "t", "ja3_hash": "47a74b02e799641e8c468d31e97993b7", "ja3_variant_count": 1, "ja3_variants": [ "47a74b02e799641e8c468d31e97993b7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d1e038da55b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d1e038da55b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-45-0-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789747134, "last_seen": 1789747134, "transport": "t", "ja3_hash": "d4bde206f575d544e8233f30ae3e1be9", "ja3_variant_count": 1, "ja3_variants": [ "d4bde206f575d544e8233f30ae3e1be9" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/153.0.8010.24 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_e13542d9dc06", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "e13542d9dc06", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-51-27-17613-0-45,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789048599, "last_seen": 1789048599, "transport": "t", "ja3_hash": "f3c3c1aa40ebb010fc01b29a4388382a", "ja3_variant_count": 1, "ja3_variants": [ "f3c3c1aa40ebb010fc01b29a4388382a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 8 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_e563932f5797", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "e563932f5797", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-18-17613-27-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789694813, "last_seen": 1789694813, "transport": "t", "ja3_hash": "331b5c461429e36f4144b36d34475e9e", "ja3_variant_count": 1, "ja3_variants": [ "331b5c461429e36f4144b36d34475e9e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_e8707c638f34", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "e8707c638f34", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-23-0-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788745817, "last_seen": 1788745817, "transport": "t", "ja3_hash": "c2e19fed91d63cd18083f5593ac1218f", "ja3_variant_count": 1, "ja3_variants": [ "c2e19fed91d63cd18083f5593ac1218f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_115d5d4d0596", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "115d5d4d0596", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-16-5-23-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789647908, "last_seen": 1789647908, "transport": "t", "ja3_hash": "839d98a6397e48fe7677d885008dbd2c", "ja3_variant_count": 1, "ja3_variants": [ "839d98a6397e48fe7677d885008dbd2c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 90 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_1298b609779b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "1298b609779b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65037-0-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024343, "last_seen": 1789024343, "transport": "t", "ja3_hash": "ccdfe6823c99dcdfe5f7d32972d8c3e2", "ja3_variant_count": 1, "ja3_variants": [ "ccdfe6823c99dcdfe5f7d32972d8c3e2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_130693274701", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "130693274701", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-16-0-65037-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789776181, "last_seen": 1789776181, "transport": "t", "ja3_hash": "3c069d1f3dbb9a2f478e544fbd2f861f", "ja3_variant_count": 1, "ja3_variants": [ "3c069d1f3dbb9a2f478e544fbd2f861f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 33 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_1dca2383d6a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "1dca2383d6a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-11-13-0-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789746721, "last_seen": 1789746721, "transport": "t", "ja3_hash": "bca7b20391f889649a643139d98ad297", "ja3_variant_count": 1, "ja3_variants": [ "bca7b20391f889649a643139d98ad297" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_4c6668cd1174", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "4c6668cd1174", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-51764-23-0-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789737288, "last_seen": 1789737288, "transport": "t", "ja3_hash": "ccbd6c9decd8d561220bbeede877484a", "ja3_variant_count": 1, "ja3_variants": [ "ccbd6c9decd8d561220bbeede877484a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_5deea1d9b0b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "5deea1d9b0b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-45-17613-0-23-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788979961, "last_seen": 1789516977, "transport": "t", "ja3_hash": "db7ff95d7beb81bbcc44eee9cf746bb6", "ja3_variant_count": 2, "ja3_variants": [ "db7ff95d7beb81bbcc44eee9cf746bb6", "a18796f9b0c25f8f7cb554593633841d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 15 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_736e2dd1c234", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "736e2dd1c234", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-17613-35-16-45-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788460006, "last_seen": 1788460006, "transport": "t", "ja3_hash": "1a896bc34249e4709a9edb361a9dd396", "ja3_variant_count": 1, "ja3_variants": [ "1a896bc34249e4709a9edb361a9dd396" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_747673b6b315", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "747673b6b315", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-5-18-27-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789902638, "last_seen": 1789902638, "transport": "t", "ja3_hash": "2a43cbbc8cfad4c3b677ed17f0da2b15", "ja3_variant_count": 1, "ja3_variants": [ "2a43cbbc8cfad4c3b677ed17f0da2b15" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_9e6f74212d64", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "9e6f74212d64", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-11-16-45-65281-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789684464, "last_seen": 1789684464, "transport": "t", "ja3_hash": "8b2f156a10ffba310a544f9a6158e839", "ja3_variant_count": 1, "ja3_variants": [ "8b2f156a10ffba310a544f9a6158e839" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_9ec465a7d568", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "9ec465a7d568", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-65281-23-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789092655, "last_seen": 1789092655, "transport": "t", "ja3_hash": "349f80e7954d7ece430d272f66781bf6", "ja3_variant_count": 1, "ja3_variants": [ "349f80e7954d7ece430d272f66781bf6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_e8afc78fbf38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "e8afc78fbf38", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-0-23-16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789100228, "last_seen": 1789100228, "transport": "t", "ja3_hash": "1c5211b7119ff0b1aaf0603c41e7c30a", "ja3_variant_count": 1, "ja3_variants": [ "1c5211b7119ff0b1aaf0603c41e7c30a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507ht_8daaf6152771_6bfe2c96115f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507ht", "b": "8daaf6152771", "c": "6bfe2c96115f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-16-35-45-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788880395, "last_seen": 1788880395, "transport": "t", "ja3_hash": "58f149c6dfe7f69374b18e9f37761098", "ja3_variant_count": 1, "ja3_variants": [ "58f149c6dfe7f69374b18e9f37761098" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507ht_8daaf6152771_b47fc9b4680f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507ht", "b": "8daaf6152771", "c": "b47fc9b4680f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-65281-0-18-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788847909, "last_seen": 1788847909, "transport": "t", "ja3_hash": "7b07a2ea45e4e4d9b60037da73e08c05", "ja3_variant_count": 1, "ja3_variants": [ "7b07a2ea45e4e4d9b60037da73e08c05" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507ht_8daaf6152771_e231591552cf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507ht", "b": "8daaf6152771", "c": "e231591552cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-10-0-13-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788820112, "last_seen": 1788820112, "transport": "t", "ja3_hash": "3bb18bd0ece6ca9f5a7a2de89b1ace51", "ja3_variant_count": 1, "ja3_variants": [ "3bb18bd0ece6ca9f5a7a2de89b1ace51" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507ht_8daaf6152771_e96886817260", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507ht", "b": "8daaf6152771", "c": "e96886817260", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-16-23-27-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789437744, "last_seen": 1789437744, "transport": "t", "ja3_hash": "a665828fb58b1fceb047e4e4815cf9fc", "ja3_variant_count": 1, "ja3_variants": [ "a665828fb58b1fceb047e4e4815cf9fc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507ht_8daaf6152771_eb2f2971525c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507ht", "b": "8daaf6152771", "c": "eb2f2971525c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-0-23-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788860927, "last_seen": 1788860927, "transport": "t", "ja3_hash": "5d527af0d2a9405b74c2024e13a49c83", "ja3_variant_count": 1, "ja3_variants": [ "5d527af0d2a9405b74c2024e13a49c83" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_00309e18d362", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "00309e18d362", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-27-17613-10-65281-51-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788724247, "last_seen": 1788724247, "transport": "t", "ja3_hash": "c790421a16bca5d34dc87285488d5dbf", "ja3_variant_count": 1, "ja3_variants": [ "c790421a16bca5d34dc87285488d5dbf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_0b21a40b059d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "0b21a40b059d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-11-35-65037-13-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789008564, "last_seen": 1789008564, "transport": "t", "ja3_hash": "31f658cfc2bf758d24e4c3cc774a2bb4", "ja3_variant_count": 1, "ja3_variants": [ "31f658cfc2bf758d24e4c3cc774a2bb4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_19141369d0fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "19141369d0fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-0-18-11-27-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788812127, "last_seen": 1788812127, "transport": "t", "ja3_hash": "b09b05f07f584913c86c69cbac090c07", "ja3_variant_count": 1, "ja3_variants": [ "b09b05f07f584913c86c69cbac090c07" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_214457f16040", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "214457f16040", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-5-45-0-23-18-35,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789735715, "last_seen": 1789735715, "transport": "t", "ja3_hash": "e4d68ecec0c91a182d94c8ca7982feea", "ja3_variant_count": 1, "ja3_variants": [ "e4d68ecec0c91a182d94c8ca7982feea" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_293bdad97863", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "293bdad97863", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-17613-0-65281-11-18-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788556602, "last_seen": 1788556602, "transport": "t", "ja3_hash": "1a7163a380619e4952d510003bfd8ac6", "ja3_variant_count": 1, "ja3_variants": [ "1a7163a380619e4952d510003bfd8ac6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_4b8f4a2f1bf6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "4b8f4a2f1bf6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-65037-13-11-0-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788845619, "last_seen": 1788845619, "transport": "t", "ja3_hash": "48b140c3afd9a9c0f51c55a113f9ce52", "ja3_variant_count": 1, "ja3_variants": [ "48b140c3afd9a9c0f51c55a113f9ce52" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_4d62064720ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "4d62064720ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-5-65037-0-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788851068, "last_seen": 1788851068, "transport": "t", "ja3_hash": "3f0fb1268a21e2ce36aa3ee36debb7a1", "ja3_variant_count": 1, "ja3_variants": [ "3f0fb1268a21e2ce36aa3ee36debb7a1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 YaBrowser/26.6.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_54b56c58a487", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "54b56c58a487", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-27-0-18-45-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788781899, "last_seen": 1788781899, "transport": "t", "ja3_hash": "c9732ee0b3e5f456d304d228e975541a", "ja3_variant_count": 1, "ja3_variants": [ "c9732ee0b3e5f456d304d228e975541a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_5ad293fdd18d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "5ad293fdd18d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-0-65037-13-35-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789576911, "last_seen": 1789576911, "transport": "t", "ja3_hash": "502a32a5c4a65cecf7aa0fa1205a1dce", "ja3_variant_count": 1, "ja3_variants": [ "502a32a5c4a65cecf7aa0fa1205a1dce" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_5c9f8830e355", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "5c9f8830e355", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-23-0-27-18-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788801888, "last_seen": 1788801888, "transport": "t", "ja3_hash": "61d8f171b0cc84b153de24b6b66fbd5f", "ja3_variant_count": 1, "ja3_variants": [ "61d8f171b0cc84b153de24b6b66fbd5f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_7d6466bb9a86", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "7d6466bb9a86", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-17613-65281-11-27-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789798025, "last_seen": 1789798025, "transport": "t", "ja3_hash": "65d722b1290f5b454544b65957ed024f", "ja3_variant_count": 1, "ja3_variants": [ "65d722b1290f5b454544b65957ed024f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_851c60ffc66d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "851c60ffc66d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-0-17613-65037-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788764755, "last_seen": 1788764755, "transport": "t", "ja3_hash": "5bcb1670fdbb8dbe4f950b90889486e5", "ja3_variant_count": 1, "ja3_variants": [ "5bcb1670fdbb8dbe4f950b90889486e5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a505fe1c753d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a505fe1c753d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-0-51-27-10-35-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788959689, "last_seen": 1788959689, "transport": "t", "ja3_hash": "9e636039482269c983cba5b1300b9cd0", "ja3_variant_count": 1, "ja3_variants": [ "9e636039482269c983cba5b1300b9cd0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a859c0f58553", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a859c0f58553", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-23-45-65281-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789576540, "last_seen": 1789576540, "transport": "t", "ja3_hash": "a4ea0c8d8b350d5b780c0d7c22d31668", "ja3_variant_count": 1, "ja3_variants": [ "a4ea0c8d8b350d5b780c0d7c22d31668" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_f6d88400e4eb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "f6d88400e4eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-27-11-13-65037-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789348873, "last_seen": 1789348873, "transport": "t", "ja3_hash": "9d4288f536f814c03b34b0546f167686", "ja3_variant_count": 1, "ja3_variants": [ "9d4288f536f814c03b34b0546f167686" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_62ed8481507b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "62ed8481507b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-16-0-23-45-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789751371, "last_seen": 1789751371, "transport": "t", "ja3_hash": "4a46d00015a27707f2863a4ffbe931ba", "ja3_variant_count": 1, "ja3_variants": [ "4a46d00015a27707f2863a4ffbe931ba" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_77a600148ece", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "77a600148ece", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-16-27-0-45-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789666819, "last_seen": 1789666819, "transport": "t", "ja3_hash": "47663536ae4cf775d38c96f3be888ca1", "ja3_variant_count": 1, "ja3_variants": [ "47663536ae4cf775d38c96f3be888ca1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_8fdc367e25c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "8fdc367e25c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-18-35-10-45-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788590371, "last_seen": 1788590371, "transport": "t", "ja3_hash": "2ccbbd4c97046baa968a6b58a52faf1b", "ja3_variant_count": 1, "ja3_variants": [ "2ccbbd4c97046baa968a6b58a52faf1b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_945668e0c70e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "945668e0c70e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-11-0-17613-51-5-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789269663, "last_seen": 1789269663, "transport": "t", "ja3_hash": "488451d90f0bb8dba09699906a22fb2f", "ja3_variant_count": 1, "ja3_variants": [ "488451d90f0bb8dba09699906a22fb2f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_a3ad0ff574ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "a3ad0ff574ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-11-27-0-51-65281-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789686184, "last_seen": 1789686184, "transport": "t", "ja3_hash": "0cd2c307ca967f3e26cfeb99d302e70b", "ja3_variant_count": 1, "ja3_variants": [ "0cd2c307ca967f3e26cfeb99d302e70b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_a77bd6e9a962", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "a77bd6e9a962", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-0-23-18-10-45-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788723979, "last_seen": 1788723979, "transport": "t", "ja3_hash": "fc7cc7a836924338d6040c66d19ba75d", "ja3_variant_count": 1, "ja3_variants": [ "fc7cc7a836924338d6040c66d19ba75d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_bb28d51f298a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "bb28d51f298a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-23-10-0-35-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788798364, "last_seen": 1788798364, "transport": "t", "ja3_hash": "835a36bf7d600792ce1c75cfe3bbb879", "ja3_variant_count": 1, "ja3_variants": [ "835a36bf7d600792ce1c75cfe3bbb879" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_bebc93064de2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "bebc93064de2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-0-16-5-23-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789066181, "last_seen": 1789066181, "transport": "t", "ja3_hash": "c9aa4a8ed0d71a0b2030311dedef909b", "ja3_variant_count": 1, "ja3_variants": [ "c9aa4a8ed0d71a0b2030311dedef909b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_f71fcdef798d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "f71fcdef798d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-35-18-65037-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788899644, "last_seen": 1789006092, "transport": "t", "ja3_hash": "e54c488c45ee321e91f274049e02d4d8", "ja3_variant_count": 2, "ja3_variants": [ "e54c488c45ee321e91f274049e02d4d8", "0e9d9a708e2f904b7d289a310411c919" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 7, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508ht_8daaf6152771_435c3d1794a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508ht", "b": "8daaf6152771", "c": "435c3d1794a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-5-16-65281-65037-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789452087, "last_seen": 1789452087, "transport": "t", "ja3_hash": "a7a9447ae1aa81d11223bf8ed3e79543", "ja3_variant_count": 1, "ja3_variants": [ "a7a9447ae1aa81d11223bf8ed3e79543" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508ht_8daaf6152771_50db23698a96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508ht", "b": "8daaf6152771", "c": "50db23698a96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-13-0-65037-16-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789625074, "last_seen": 1789625074, "transport": "t", "ja3_hash": "e14e2517b8dd88da4024f150434d73a3", "ja3_variant_count": 1, "ja3_variants": [ "e14e2517b8dd88da4024f150434d73a3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508ht_8daaf6152771_5f5864d3a276", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508ht", "b": "8daaf6152771", "c": "5f5864d3a276", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-5-0-65037-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788805169, "last_seen": 1788805169, "transport": "t", "ja3_hash": "76052d29f71f81561da0d8ae62d9d8e7", "ja3_variant_count": 1, "ja3_variants": [ "76052d29f71f81561da0d8ae62d9d8e7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508ht_8daaf6152771_6d592bb73386", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508ht", "b": "8daaf6152771", "c": "6d592bb73386", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-13-23-5-16-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788704081, "last_seen": 1788704081, "transport": "t", "ja3_hash": "894630188413eee99bead2cce3e97ad9", "ja3_variant_count": 1, "ja3_variants": [ "894630188413eee99bead2cce3e97ad9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508ht_8daaf6152771_9889064fee1d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508ht", "b": "8daaf6152771", "c": "9889064fee1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-45-65281-11-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788824948, "last_seen": 1788824948, "transport": "t", "ja3_hash": "fe6ab2080eff5283c83aa223f3269f60", "ja3_variant_count": 1, "ja3_variants": [ "fe6ab2080eff5283c83aa223f3269f60" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508ht_8daaf6152771_d61a09890e3d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508ht", "b": "8daaf6152771", "c": "d61a09890e3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-5-45-35-51-16-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789638737, "last_seen": 1789638737, "transport": "t", "ja3_hash": "12d5a87f4a4eb18801119216334a5742", "ja3_variant_count": 1, "ja3_variants": [ "12d5a87f4a4eb18801119216334a5742" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508ht_8daaf6152771_fffe448a348e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508ht", "b": "8daaf6152771", "c": "fffe448a348e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-11-10-65037-27-13-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788820103, "last_seen": 1788820103, "transport": "t", "ja3_hash": "f5339c71190c516781bfef5438790438", "ja3_variant_count": 1, "ja3_variants": [ "f5339c71190c516781bfef5438790438" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_0fd65098570f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "0fd65098570f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-11-65281-65037-5-0-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789009459, "last_seen": 1789009459, "transport": "t", "ja3_hash": "781302c621023bc4a0309b7f1059e8a0", "ja3_variant_count": 1, "ja3_variants": [ "781302c621023bc4a0309b7f1059e8a0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_4e00e9624d0c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "4e00e9624d0c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-23-13-35-0-5-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789033655, "last_seen": 1789033655, "transport": "t", "ja3_hash": "4d76d3631872c8a801002d3464f4820c", "ja3_variant_count": 1, "ja3_variants": [ "4d76d3631872c8a801002d3464f4820c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_64c05488f0c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "64c05488f0c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-5-0-27-23-65037-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789964831, "last_seen": 1789964831, "transport": "t", "ja3_hash": "6fb93722c0152573b436ff554aadb1fb", "ja3_variant_count": 1, "ja3_variants": [ "6fb93722c0152573b436ff554aadb1fb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_6a2156c240f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "6a2156c240f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-45-5-0-27-51-18-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789628496, "last_seen": 1789628496, "transport": "t", "ja3_hash": "225e48441b43892d339df3a7c18107ad", "ja3_variant_count": 1, "ja3_variants": [ "225e48441b43892d339df3a7c18107ad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_753545e98d49", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "753545e98d49", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-65281-18-23-27-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788998444, "last_seen": 1788998444, "transport": "t", "ja3_hash": "8c40dd38b97894a21fc835f5d33c4358", "ja3_variant_count": 1, "ja3_variants": [ "8c40dd38b97894a21fc835f5d33c4358" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_89f955ecc8ba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "89f955ecc8ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-51764-18-17613-65281-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789750054, "last_seen": 1789750054, "transport": "t", "ja3_hash": "ce104668376d56b6168a91527645993a", "ja3_variant_count": 1, "ja3_variants": [ "ce104668376d56b6168a91527645993a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_9a968430898c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "9a968430898c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-35-13-18-45-65281-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789283189, "last_seen": 1789283189, "transport": "t", "ja3_hash": "a13e2320624951bd8a218234600fba1f", "ja3_variant_count": 1, "ja3_variants": [ "a13e2320624951bd8a218234600fba1f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_b2d023f7765d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "b2d023f7765d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-65037-10-23-35-65281-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789839798, "last_seen": 1789839798, "transport": "t", "ja3_hash": "9b84ff51dbc14d8be6a65d1bbca9f997", "ja3_variant_count": 1, "ja3_variants": [ "9b84ff51dbc14d8be6a65d1bbca9f997" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_bd302e63541f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "bd302e63541f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-35-5-27-45-17613-23-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789517329, "last_seen": 1789517329, "transport": "t", "ja3_hash": "90808fddc331b133750165b389ac03a0", "ja3_variant_count": 1, "ja3_variants": [ "90808fddc331b133750165b389ac03a0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_c06fde8eb55b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "c06fde8eb55b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-11-5-51764-35-65281-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789063168, "last_seen": 1789063168, "transport": "t", "ja3_hash": "c35edce37db3303323651dc1e1b69c33", "ja3_variant_count": 1, "ja3_variants": [ "c35edce37db3303323651dc1e1b69c33" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 23 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_c0f419eee790", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "c0f419eee790", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-65037-27-65281-10-0-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788798643, "last_seen": 1788798643, "transport": "t", "ja3_hash": "40da22d5e5262254acf08a44d7c4c5ba", "ja3_variant_count": 1, "ja3_variants": [ "40da22d5e5262254acf08a44d7c4c5ba" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_c2e37bf9a8ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "c2e37bf9a8ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-27-13-0-5-23-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789682022, "last_seen": 1789682022, "transport": "t", "ja3_hash": "f91cefaea172c75697b87becfe6ad729", "ja3_variant_count": 1, "ja3_variants": [ "f91cefaea172c75697b87becfe6ad729" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_e4de5e82ef73", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "e4de5e82ef73", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-18-65281-5-51-17613-45-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789570709, "last_seen": 1789570709, "transport": "t", "ja3_hash": "ec3d3e385e901bacab8dfe3fa9d213f2", "ja3_variant_count": 1, "ja3_variants": [ "ec3d3e385e901bacab8dfe3fa9d213f2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_eb208de54404", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "eb208de54404", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65037-5-11-45-27-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788887872, "last_seen": 1788887872, "transport": "t", "ja3_hash": "b41cda1ff03854d07af1cb23f5ae75f6", "ja3_variant_count": 1, "ja3_variants": [ "b41cda1ff03854d07af1cb23f5ae75f6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_ef9280127124", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "ef9280127124", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-45-17613-0-5-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789028523, "last_seen": 1789028523, "transport": "t", "ja3_hash": "c47d0afbf76f5bbab5db0842c08fdf18", "ja3_variant_count": 1, "ja3_variants": [ "c47d0afbf76f5bbab5db0842c08fdf18" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_f5faadd4032b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "f5faadd4032b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-35-11-27-45-23-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788739289, "last_seen": 1788739289, "transport": "t", "ja3_hash": "3f47eb1769ca2f4bc21c308d9f41414e", "ja3_variant_count": 1, "ja3_variants": [ "3f47eb1769ca2f4bc21c308d9f41414e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_fe09333a7d32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "fe09333a7d32", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-18-65281-51-35-45-0-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789776184, "last_seen": 1789776184, "transport": "t", "ja3_hash": "e485549c4bce7ee2c338052753967c49", "ja3_variant_count": 1, "ja3_variants": [ "e485549c4bce7ee2c338052753967c49" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_073e58a039a6_7081e2cbd3c7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d1509h2", "b": "073e58a039a6", "c": "7081e2cbd3c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-51-57-47-53-10,0-23-65281-10-11-35-16-5-13,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789546279, "last_seen": 1789546279, "transport": "t", "ja3_hash": "0ffee3ba8e615ad22535e7f771690a28", "ja3_variant_count": 1, "ja3_variants": [ "0ffee3ba8e615ad22535e7f771690a28" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_17d58b7b81b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "17d58b7b81b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-0-5-10-13-18-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789214264, "last_seen": 1789214264, "transport": "t", "ja3_hash": "b51c1ef2b9265c55a2402e30d38df08c", "ja3_variant_count": 1, "ja3_variants": [ "b51c1ef2b9265c55a2402e30d38df08c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_19c4b027752a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "19c4b027752a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 95, "first_seen": 1787540630, "last_seen": 1788768245, "transport": "t", "ja3_hash": "6d7fcd8d30bce4bae53bdcf30033f901", "ja3_variant_count": 1, "ja3_variants": [ "6d7fcd8d30bce4bae53bdcf30033f901" ], "user_agents": { "Mozilla/5.0 (Android 13; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 874, "Mozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 12, "Mozilla/5.0 (Android 17; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 37 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_267e13b70f90", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "267e13b70f90", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-45-35-0-10-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788759950, "last_seen": 1788759950, "transport": "t", "ja3_hash": "9e6e0583a304812dc7ec8c60a74af537", "ja3_variant_count": 1, "ja3_variants": [ "9e6e0583a304812dc7ec8c60a74af537" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_686ce6f72082", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "686ce6f72082", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-16-0-27-13-23-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789174737, "last_seen": 1789174737, "transport": "t", "ja3_hash": "bf68021036d497927ee4cea6b1cff60b", "ja3_variant_count": 1, "ja3_variants": [ "bf68021036d497927ee4cea6b1cff60b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_6a0fb5f56cc2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "6a0fb5f56cc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-17613-51764-65037-5-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789729282, "last_seen": 1789729282, "transport": "t", "ja3_hash": "a6385fbfb1bc90baa59c05c4953c2ac3", "ja3_variant_count": 1, "ja3_variants": [ "a6385fbfb1bc90baa59c05c4953c2ac3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_7a850863f715", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "7a850863f715", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-11-17613-16-10-5-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788761165, "last_seen": 1788761165, "transport": "t", "ja3_hash": "4f0d76e6a57342a4a536dc0185593dde", "ja3_variant_count": 1, "ja3_variants": [ "4f0d76e6a57342a4a536dc0185593dde" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_8c6b904f3484", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "8c6b904f3484", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-17613-23-0-35-45-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789601231, "last_seen": 1789601231, "transport": "t", "ja3_hash": "0b9324967dc6a46fee17adefd53dda10", "ja3_variant_count": 1, "ja3_variants": [ "0b9324967dc6a46fee17adefd53dda10" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_ac81127c1fe2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "ac81127c1fe2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-65037-17613-0-11-16-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788620750, "last_seen": 1788620750, "transport": "t", "ja3_hash": "502c4890227aa9162dc55fbda8bad950", "ja3_variant_count": 1, "ja3_variants": [ "502c4890227aa9162dc55fbda8bad950" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_af4000ee41b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "af4000ee41b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-18-45-11-16-23-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788964851, "last_seen": 1788964851, "transport": "t", "ja3_hash": "5471b17efce41b83d483ee5ad5d224ed", "ja3_variant_count": 1, "ja3_variants": [ "5471b17efce41b83d483ee5ad5d224ed" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_b5c435c068e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "b5c435c068e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-23-45-13-5-0-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789688743, "last_seen": 1789688743, "transport": "t", "ja3_hash": "0426bae1ce4a38bf334aa5f742438f35", "ja3_variant_count": 1, "ja3_variants": [ "0426bae1ce4a38bf334aa5f742438f35" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e941755b183a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e941755b183a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-65281-27-0-16-51-18-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730603, "last_seen": 1789730603, "transport": "t", "ja3_hash": "870f7e0cceac5851e494ca7e08effcac", "ja3_variant_count": 1, "ja3_variants": [ "870f7e0cceac5851e494ca7e08effcac" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e98aeb888944", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e98aeb888944", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-17613-10-65037-45-0-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789006195, "last_seen": 1789006195, "transport": "t", "ja3_hash": "c8e6d8af0fb240a02ea5395c3de92ebd", "ja3_variant_count": 1, "ja3_variants": [ "c8e6d8af0fb240a02ea5395c3de92ebd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_f03bc0c113ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "f03bc0c113ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-16-17613-0-13-5-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789021800, "last_seen": 1789021800, "transport": "t", "ja3_hash": "ed8829eddf9ce9e9f256220e800a9374", "ja3_variant_count": 1, "ja3_variants": [ "ed8829eddf9ce9e9f256220e800a9374" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_f3a98b490cb5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "f3a98b490cb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-18-5-10-65281-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789782426, "last_seen": 1789782426, "transport": "t", "ja3_hash": "150ccf2667f442dba4703a9e122c3f63", "ja3_variant_count": 1, "ja3_variants": [ "150ccf2667f442dba4703a9e122c3f63" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t12d1509ht_8daaf6152771_142ef9788fc6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509ht", "b": "8daaf6152771", "c": "142ef9788fc6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-10-16-0-27-45-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788890139, "last_seen": 1788890139, "transport": "t", "ja3_hash": "ad6acb28b48db543aee9621b653cab59", "ja3_variant_count": 1, "ja3_variants": [ "ad6acb28b48db543aee9621b653cab59" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509ht_8daaf6152771_2b5f3a5da0ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509ht", "b": "8daaf6152771", "c": "2b5f3a5da0ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-16-13-35-45-65037-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788886292, "last_seen": 1788886292, "transport": "t", "ja3_hash": "18df42a69cc412071376c27ce05bd113", "ja3_variant_count": 1, "ja3_variants": [ "18df42a69cc412071376c27ce05bd113" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509ht_8daaf6152771_621e6f49ac8e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509ht", "b": "8daaf6152771", "c": "621e6f49ac8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-10-65037-35-5-0-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788836695, "last_seen": 1788836695, "transport": "t", "ja3_hash": "5621f7cf70211d0ccfbf3d427c24c8e6", "ja3_variant_count": 1, "ja3_variants": [ "5621f7cf70211d0ccfbf3d427c24c8e6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509ht_8daaf6152771_b5ffe25e22c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509ht", "b": "8daaf6152771", "c": "b5ffe25e22c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-65281-0-16-13-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789158071, "last_seen": 1789158071, "transport": "t", "ja3_hash": "f79d5d4b18ee081b4b2cc0014586c0ab", "ja3_variant_count": 1, "ja3_variants": [ "f79d5d4b18ee081b4b2cc0014586c0ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509ht_8daaf6152771_d8f7246e695f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509ht", "b": "8daaf6152771", "c": "d8f7246e695f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-51-16-18-17613-0-27-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788971847, "last_seen": 1788971847, "transport": "t", "ja3_hash": "95bebf731066d5fe6e1cb4c9e89706ca", "ja3_variant_count": 1, "ja3_variants": [ "95bebf731066d5fe6e1cb4c9e89706ca" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509ht_8daaf6152771_f95a2205ddba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509ht", "b": "8daaf6152771", "c": "f95a2205ddba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-10-18-23-5-65037-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789625140, "last_seen": 1789625140, "transport": "t", "ja3_hash": "5bfbd96e0c2dedd681a611254dac66a5", "ja3_variant_count": 1, "ja3_variants": [ "5bfbd96e0c2dedd681a611254dac66a5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_1caa206ee25a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "1caa206ee25a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-23-27-17613-18-35-10-45-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789442129, "last_seen": 1789442129, "transport": "t", "ja3_hash": "548eaccfe70bf325139c66473765ef19", "ja3_variant_count": 1, "ja3_variants": [ "548eaccfe70bf325139c66473765ef19" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 12 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_32ec49e0152b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "32ec49e0152b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-65281-27-23-45-10-13-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789829917, "last_seen": 1789829917, "transport": "t", "ja3_hash": "d27f61046c32e10a4b3a309042773ef8", "ja3_variant_count": 1, "ja3_variants": [ "d27f61046c32e10a4b3a309042773ef8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_50df405ffc38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "50df405ffc38", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-10-45-17613-18-51764-0-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789568910, "last_seen": 1789568910, "transport": "t", "ja3_hash": "89d41c9eb46510fbfcc31b43edc03aea", "ja3_variant_count": 1, "ja3_variants": [ "89d41c9eb46510fbfcc31b43edc03aea" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_50ec25b9ab97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "50ec25b9ab97", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-27-5-65037-0-65281-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788835215, "last_seen": 1788835215, "transport": "t", "ja3_hash": "0873ab450e550d7e25e3984cc8a7d496", "ja3_variant_count": 1, "ja3_variants": [ "0873ab450e550d7e25e3984cc8a7d496" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_6a4773a3e5d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "6a4773a3e5d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-27-5-10-0-45-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788999857, "last_seen": 1788999857, "transport": "t", "ja3_hash": "d6e32c76728accabd2077abb68a3aa09", "ja3_variant_count": 1, "ja3_variants": [ "d6e32c76728accabd2077abb68a3aa09" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_737af06f94cf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "737af06f94cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-27-11-65037-18-10-13-65281-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789966779, "last_seen": 1789966779, "transport": "t", "ja3_hash": "261485000f25201e79cc3306722a6429", "ja3_variant_count": 1, "ja3_variants": [ "261485000f25201e79cc3306722a6429" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_a47e054fef0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "a47e054fef0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-17613-27-35-51764-11-23-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788948722, "last_seen": 1788948722, "transport": "t", "ja3_hash": "c2d4fcad7b13d4622c536dc3605345e9", "ja3_variant_count": 1, "ja3_variants": [ "c2d4fcad7b13d4622c536dc3605345e9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_c7bb39056392", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "c7bb39056392", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-35-11-45-5-65281-27-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788767391, "last_seen": 1788767391, "transport": "t", "ja3_hash": "9edfca88725a1b70e047a0513e0ddab8", "ja3_variant_count": 1, "ja3_variants": [ "9edfca88725a1b70e047a0513e0ddab8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_e9de89ee8a89", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "e9de89ee8a89", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-5-65281-13-17613-35-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723903, "last_seen": 1788723903, "transport": "t", "ja3_hash": "fd75745c911779cbb9ba17d8bcf6700c", "ja3_variant_count": 1, "ja3_variants": [ "fd75745c911779cbb9ba17d8bcf6700c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_064c7ff5e0dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "064c7ff5e0dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-0-16-65037-27-17613-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789443935, "last_seen": 1789443935, "transport": "t", "ja3_hash": "7ff6673fe3fb9ee31b1103715437a62a", "ja3_variant_count": 1, "ja3_variants": [ "7ff6673fe3fb9ee31b1103715437a62a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 150 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_0821d44e3287", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "0821d44e3287", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-11-65037-16-17613-10-35-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788668741, "last_seen": 1788668741, "transport": "t", "ja3_hash": "79b3bda7013444ac89ef4ed46c02f27b", "ja3_variant_count": 1, "ja3_variants": [ "79b3bda7013444ac89ef4ed46c02f27b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_1eaf60c563e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "1eaf60c563e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-45-10-0-18-23-27-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789432693, "last_seen": 1789432693, "transport": "t", "ja3_hash": "3594a2b3e583321bfa7ca2bbd9c54625", "ja3_variant_count": 1, "ja3_variants": [ "3594a2b3e583321bfa7ca2bbd9c54625" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_28c7080823c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "28c7080823c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-17613-16-23-65037-35-18-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789750613, "last_seen": 1789750613, "transport": "t", "ja3_hash": "f7e6b92ae9d7965ee14af40e5b572d5d", "ja3_variant_count": 1, "ja3_variants": [ "f7e6b92ae9d7965ee14af40e5b572d5d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_29cc5cd76a4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "29cc5cd76a4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-65281-0-10-27-16-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789028572, "last_seen": 1789028572, "transport": "t", "ja3_hash": "b55fae2ba58bbefb22741483ddd926ad", "ja3_variant_count": 1, "ja3_variants": [ "b55fae2ba58bbefb22741483ddd926ad" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_31641c40bd40", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "31641c40bd40", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-13-10-23-65281-17613-18-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788784809, "last_seen": 1788797457, "transport": "t", "ja3_hash": "fe50377a9a20b931d9889034734edad2", "ja3_variant_count": 2, "ja3_variants": [ "fe50377a9a20b931d9889034734edad2", "47883dc56d38baab9b23c18ad69db801" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 3, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_4a065df55c19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "4a065df55c19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 471, "first_seen": 1787516565, "last_seen": 1789943510, "transport": "t", "ja3_hash": "0b0b8d5f87b0a48ba36914bcef2ea47e", "ja3_variant_count": 3, "ja3_variants": [ "0b0b8d5f87b0a48ba36914bcef2ea47e", "3f18d0aaf5dfc64f9be3aa1d568a9189", "4f1e1af5ffb803ceceae1d62ae8fa94e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 15, "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 127, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 180, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 891, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 63, "Mozilla/5.0 (Android 16; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 9, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 43 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_5108843bd1cf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "5108843bd1cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-35-17613-11-13-18-16-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788760451, "last_seen": 1788760451, "transport": "t", "ja3_hash": "b90f10a94af7bd4c342d7f013d8ad697", "ja3_variant_count": 1, "ja3_variants": [ "b90f10a94af7bd4c342d7f013d8ad697" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_64a2ba4fb516", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "64a2ba4fb516", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-5-45-65037-23-17613-0-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789140925, "last_seen": 1789140925, "transport": "t", "ja3_hash": "189870719493748f21a44367d6a0bcd2", "ja3_variant_count": 1, "ja3_variants": [ "189870719493748f21a44367d6a0bcd2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 9 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_7456b419a5f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "7456b419a5f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-16-11-65037-5-18-0-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788571305, "last_seen": 1788571305, "transport": "t", "ja3_hash": "64637610e5a4cc9c2fa5c87882762363", "ja3_variant_count": 1, "ja3_variants": [ "64637610e5a4cc9c2fa5c87882762363" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_797a061ca5c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "797a061ca5c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-65281-11-17613-10-13-0-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788570651, "last_seen": 1788570651, "transport": "t", "ja3_hash": "a576fe7e2204d473da4d50dbfda048fd", "ja3_variant_count": 1, "ja3_variants": [ "a576fe7e2204d473da4d50dbfda048fd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_7f5b27f10ff0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "7f5b27f10ff0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-18-5-35-13-23-17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789201600, "last_seen": 1789201600, "transport": "t", "ja3_hash": "a5d7c70872855627ca52feb1bc77e1c2", "ja3_variant_count": 1, "ja3_variants": [ "a5d7c70872855627ca52feb1bc77e1c2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_8011625d9f9c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "8011625d9f9c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-0-16-23-13-27-5-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788443557, "last_seen": 1788443557, "transport": "t", "ja3_hash": "6caf367979e46e625439739de9820fd3", "ja3_variant_count": 1, "ja3_variants": [ "6caf367979e46e625439739de9820fd3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_aa6324e8e9b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "aa6324e8e9b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-35-10-65281-16-0-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789028256, "last_seen": 1789028256, "transport": "t", "ja3_hash": "c9a03d8ef4dff3eedc561e033709633c", "ja3_variant_count": 1, "ja3_variants": [ "c9a03d8ef4dff3eedc561e033709633c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_abcdc00e6c32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "abcdc00e6c32", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789720082, "last_seen": 1789720082, "transport": "t", "ja3_hash": "924015c57f5a543584dd5f48decc7598", "ja3_variant_count": 1, "ja3_variants": [ "924015c57f5a543584dd5f48decc7598" ], "user_agents": { "Mozilla/5.0 (Android 15; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 9 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_d72149cb519b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "d72149cb519b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-17613-5-35-27-11-16-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789929609, "last_seen": 1789929609, "transport": "t", "ja3_hash": "5cec7bb013d8e85242ab18c89892d15c", "ja3_variant_count": 1, "ja3_variants": [ "5cec7bb013d8e85242ab18c89892d15c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_e9131eb77c7c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "e9131eb77c7c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-35-45-16-5-0-17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788992987, "last_seen": 1788992987, "transport": "t", "ja3_hash": "fc905ac276fe9651a1641759751da17b", "ja3_variant_count": 1, "ja3_variants": [ "fc905ac276fe9651a1641759751da17b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_f2df6f11da9f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "f2df6f11da9f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-0-35-5-65037-16-45-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788932611, "last_seen": 1788932611, "transport": "t", "ja3_hash": "ecf5e1c262b98397f34779de5c938d2f", "ja3_variant_count": 1, "ja3_variants": [ "ecf5e1c262b98397f34779de5c938d2f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1510ht_8daaf6152771_047f82a220dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510ht", "b": "8daaf6152771", "c": "047f82a220dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-35-65037-13-5-23-0-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788845032, "last_seen": 1788845032, "transport": "t", "ja3_hash": "fdd11bef118ba3d9f8b8050a3d166b06", "ja3_variant_count": 1, "ja3_variants": [ "fdd11bef118ba3d9f8b8050a3d166b06" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510ht_8daaf6152771_2c3f3f9e1ec1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510ht", "b": "8daaf6152771", "c": "2c3f3f9e1ec1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-16-27-11-45-5-35-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788845158, "last_seen": 1788845158, "transport": "t", "ja3_hash": "9d3026631ffb340333925520cf3cb9cd", "ja3_variant_count": 1, "ja3_variants": [ "9d3026631ffb340333925520cf3cb9cd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510ht_8daaf6152771_33707317aa0b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510ht", "b": "8daaf6152771", "c": "33707317aa0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-16-23-65281-18-0-27-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788835712, "last_seen": 1788835712, "transport": "t", "ja3_hash": "d7621ad1549e9f565a872ae723733022", "ja3_variant_count": 1, "ja3_variants": [ "d7621ad1549e9f565a872ae723733022" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510ht_8daaf6152771_df310d9fbcdf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510ht", "b": "8daaf6152771", "c": "df310d9fbcdf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-65281-45-65037-16-13-27-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788850590, "last_seen": 1788850590, "transport": "t", "ja3_hash": "7a44a9c2d4192d488dd9aaed3132a252", "ja3_variant_count": 1, "ja3_variants": [ "7a44a9c2d4192d488dd9aaed3132a252" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510ht_8daaf6152771_e3b22ece39b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510ht", "b": "8daaf6152771", "c": "e3b22ece39b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-10-11-23-13-18-45-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789165173, "last_seen": 1789165173, "transport": "t", "ja3_hash": "35a3e188ecc96fa1d96b040dce146a46", "ja3_variant_count": 1, "ja3_variants": [ "35a3e188ecc96fa1d96b040dce146a46" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_31ffca6a33c0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "31ffca6a33c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-5-65281-13-27-0-35-18-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788450674, "last_seen": 1788450674, "transport": "t", "ja3_hash": "e5487b61ccea90af8d2fd1971ff0d313", "ja3_variant_count": 1, "ja3_variants": [ "e5487b61ccea90af8d2fd1971ff0d313" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_39f6bd923d92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "39f6bd923d92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-65037-17613-51764-65281-23-0-18-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811257, "last_seen": 1788811257, "transport": "t", "ja3_hash": "cca1bbc7933075b90802e1246ffa19d4", "ja3_variant_count": 1, "ja3_variants": [ "cca1bbc7933075b90802e1246ffa19d4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_405e8854d5f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "405e8854d5f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-45-13-65037-18-35-27-5-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789636892, "last_seen": 1789636892, "transport": "t", "ja3_hash": "f14d3d4ae5b2ecada0f5a9faaf7fa290", "ja3_variant_count": 1, "ja3_variants": [ "f14d3d4ae5b2ecada0f5a9faaf7fa290" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_41f8fa758964", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "41f8fa758964", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-17613-65281-35-5-11-65037-27-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789293530, "last_seen": 1789293530, "transport": "t", "ja3_hash": "c1772016b5be5b870d52d860038daf92", "ja3_variant_count": 1, "ja3_variants": [ "c1772016b5be5b870d52d860038daf92" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_8e8443ba0bde", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "8e8443ba0bde", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-27-17613-18-45-35-65037-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789899239, "last_seen": 1789899239, "transport": "t", "ja3_hash": "b0f58cf66b6dc98720c52fdbe1514ffa", "ja3_variant_count": 1, "ja3_variants": [ "b0f58cf66b6dc98720c52fdbe1514ffa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 3 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_979c64dbe299", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "979c64dbe299", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-17613-65281-45-0-13-18-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788943222, "last_seen": 1788943222, "transport": "t", "ja3_hash": "af1abd70f7af743602fcd7d2bb0f1534", "ja3_variant_count": 1, "ja3_variants": [ "af1abd70f7af743602fcd7d2bb0f1534" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_9cf718af64c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "9cf718af64c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-27-11-45-17613-65281-65037-35-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788796563, "last_seen": 1788796563, "transport": "t", "ja3_hash": "2e1077a0db64355c3b7dc8383fd4eadb", "ja3_variant_count": 1, "ja3_variants": [ "2e1077a0db64355c3b7dc8383fd4eadb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_a57a75788fbf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "a57a75788fbf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-51-65281-45-17613-0-5-35-18-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789142100, "last_seen": 1789142100, "transport": "t", "ja3_hash": "4d873fc8eafae312c2776863edc0a2e6", "ja3_variant_count": 1, "ja3_variants": [ "4d873fc8eafae312c2776863edc0a2e6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_b9078ebafdd8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "b9078ebafdd8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-13-18-51764-17613-65281-45-0-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669087, "last_seen": 1789669087, "transport": "t", "ja3_hash": "b15f7a2b0089827434da1e8264fac33b", "ja3_variant_count": 1, "ja3_variants": [ "b15f7a2b0089827434da1e8264fac33b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_d24b5a63cb8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "d24b5a63cb8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-0-13-23-65037-10-65281-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789446846, "last_seen": 1789446846, "transport": "t", "ja3_hash": "9bf466d5d3e30ba3ca09292e3bd555b3", "ja3_variant_count": 1, "ja3_variants": [ "9bf466d5d3e30ba3ca09292e3bd555b3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_e86c81d884a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "e86c81d884a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-23-17613-0-10-18-65281-13-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788979955, "last_seen": 1788979955, "transport": "t", "ja3_hash": "55260d9dc4c2db4f64d61c92580cee47", "ja3_variant_count": 1, "ja3_variants": [ "55260d9dc4c2db4f64d61c92580cee47" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_09c57bba7bb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "09c57bba7bb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 166, "first_seen": 1787485232, "last_seen": 1789884941, "transport": "t", "ja3_hash": "e02c0f4e2781534ad53eed6393e007b2", "ja3_variant_count": 3, "ja3_variants": [ "e02c0f4e2781534ad53eed6393e007b2", "518c1854ccc5e24f40f10ce5417d83f4", "ca159e57d8ffb379a7d4548205fef76f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 9, "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 152, "Mozilla/5.0 (Android 14; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 41, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 23, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 127, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 163, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 8 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_12ac04d72c83", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "12ac04d72c83", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-16-45-65037-13-11-35-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788657960, "last_seen": 1788657960, "transport": "t", "ja3_hash": "3aa2a868558f9199d75b6c92e0b8c50c", "ja3_variant_count": 1, "ja3_variants": [ "3aa2a868558f9199d75b6c92e0b8c50c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 15 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_16129b27e950", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "16129b27e950", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-13-17613-10-27-65037-16-45-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789688320, "last_seen": 1789688320, "transport": "t", "ja3_hash": "4343e82c071f76e10b9484e6bfd4cb03", "ja3_variant_count": 1, "ja3_variants": [ "4343e82c071f76e10b9484e6bfd4cb03" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_3569fb37f72a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "3569fb37f72a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-10-35-45-65037-11-0-5-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788451790, "last_seen": 1788451790, "transport": "t", "ja3_hash": "9f4796e185998c3cf85e9fbcb5af101d", "ja3_variant_count": 1, "ja3_variants": [ "9f4796e185998c3cf85e9fbcb5af101d" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_35c15a818768", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "35c15a818768", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-0-27-18-45-23-35-65281-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788680458, "last_seen": 1788680458, "transport": "t", "ja3_hash": "87987487f96a5edd615aea5b225af664", "ja3_variant_count": 1, "ja3_variants": [ "87987487f96a5edd615aea5b225af664" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_68a830f9f41b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "68a830f9f41b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-65037-27-16-10-18-11-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789689538, "last_seen": 1789689538, "transport": "t", "ja3_hash": "ddcbcfaa589daa7b9b78b6afe0edee87", "ja3_variant_count": 1, "ja3_variants": [ "ddcbcfaa589daa7b9b78b6afe0edee87" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_8233bdbe604a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "8233bdbe604a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-65037-65281-27-0-23-45-35-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789681490, "last_seen": 1789681490, "transport": "t", "ja3_hash": "496f3ebd14e0e73edd17ba8ec39258d1", "ja3_variant_count": 1, "ja3_variants": [ "496f3ebd14e0e73edd17ba8ec39258d1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_86a73e648689", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "86a73e648689", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-13-0-27-18-65281-11-65037-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788798458, "last_seen": 1788798458, "transport": "t", "ja3_hash": "1d4f9bcc3aa36a82227faf332d1d6279", "ja3_variant_count": 1, "ja3_variants": [ "1d4f9bcc3aa36a82227faf332d1d6279" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_8a4f5bed057f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "8a4f5bed057f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-5-16-65037-13-45-10-35-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788572622, "last_seen": 1788572622, "transport": "t", "ja3_hash": "7b782fcebd3eb8ca1f63ced973ff1b39", "ja3_variant_count": 1, "ja3_variants": [ "7b782fcebd3eb8ca1f63ced973ff1b39" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_d3db1c9b03b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "d3db1c9b03b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-10-5-13-65281-35-11-27-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788647906, "last_seen": 1788647906, "transport": "t", "ja3_hash": "38a1e71d2d07246b7a0b5ff9d6a2ff45", "ja3_variant_count": 1, "ja3_variants": [ "38a1e71d2d07246b7a0b5ff9d6a2ff45" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_d851df99f70b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "d851df99f70b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-35-10-45-16-13-0-17613-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789006505, "last_seen": 1789006505, "transport": "t", "ja3_hash": "dde6dbdfca0cf07bfeb3a65db4815aa8", "ja3_variant_count": 1, "ja3_variants": [ "dde6dbdfca0cf07bfeb3a65db4815aa8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_f0228183adfd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "f0228183adfd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65281-17613-11-65037-0-27-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788709920, "last_seen": 1788709920, "transport": "t", "ja3_hash": "4fd786c3f494c4427f2391740f48a54c", "ja3_variant_count": 1, "ja3_variants": [ "4fd786c3f494c4427f2391740f48a54c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511ht_8daaf6152771_08a2ba073881", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511ht", "b": "8daaf6152771", "c": "08a2ba073881", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-16-45-23-65281-65037-27-5-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789883422, "last_seen": 1789883422, "transport": "t", "ja3_hash": "254303ef75e976ecaf02e80f822e333d", "ja3_variant_count": 1, "ja3_variants": [ "254303ef75e976ecaf02e80f822e333d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511ht_8daaf6152771_3a24fc0064f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511ht", "b": "8daaf6152771", "c": "3a24fc0064f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-35-27-18-65037-0-13-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788820166, "last_seen": 1788820166, "transport": "t", "ja3_hash": "96524d76f77dc3435af4360f12ed1c72", "ja3_variant_count": 1, "ja3_variants": [ "96524d76f77dc3435af4360f12ed1c72" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511ht_8daaf6152771_5a056eeeb5e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511ht", "b": "8daaf6152771", "c": "5a056eeeb5e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-11-18-35-16-0-10-65037-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789633655, "last_seen": 1789633655, "transport": "t", "ja3_hash": "381f3aa653e1bca25e4ac5d9520a30a4", "ja3_variant_count": 1, "ja3_variants": [ "381f3aa653e1bca25e4ac5d9520a30a4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_108fff90ab23", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "108fff90ab23", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-35-0-11-10-13-5-45-65281-23-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789635293, "last_seen": 1789635293, "transport": "t", "ja3_hash": "77fca4004f1df0395154da1896e4b44b", "ja3_variant_count": 1, "ja3_variants": [ "77fca4004f1df0395154da1896e4b44b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_1ffeb9beebad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "1ffeb9beebad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-23-35-27-45-5-10-18-17613-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788691347, "last_seen": 1788691347, "transport": "t", "ja3_hash": "147dc184688304c23c6f1373a2bd1b6b", "ja3_variant_count": 1, "ja3_variants": [ "147dc184688304c23c6f1373a2bd1b6b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_29db12fd3636", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "29db12fd3636", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-65281-5-45-11-17613-10-18-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788851366, "last_seen": 1788851366, "transport": "t", "ja3_hash": "7fb8c1c3b539a8ef4762a455868fabc5", "ja3_variant_count": 1, "ja3_variants": [ "7fb8c1c3b539a8ef4762a455868fabc5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_5dc1fa1c868b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "5dc1fa1c868b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-10-45-65037-23-18-0-13-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788722813, "last_seen": 1788722813, "transport": "t", "ja3_hash": "653cdda61ca2ff6dae40ee06e9c8c60b", "ja3_variant_count": 1, "ja3_variants": [ "653cdda61ca2ff6dae40ee06e9c8c60b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_dea9b2028811", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "dea9b2028811", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-23-45-0-65281-17613-10-13-5-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788787216, "last_seen": 1788787216, "transport": "t", "ja3_hash": "ab472e71e6578fc3d9d113b0c6418211", "ja3_variant_count": 1, "ja3_variants": [ "ab472e71e6578fc3d9d113b0c6418211" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_1956fb743284", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "1956fb743284", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-0-16-11-35-18-27-13-65281-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788528953, "last_seen": 1788528953, "transport": "t", "ja3_hash": "00a58d89d0da798bce63e9eb966812ec", "ja3_variant_count": 1, "ja3_variants": [ "00a58d89d0da798bce63e9eb966812ec" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_201ebf1a9a21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "201ebf1a9a21", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-16-23-18-35-0-5-45-10-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788821035, "last_seen": 1788821035, "transport": "t", "ja3_hash": "967386ff0944b010a4ccd3fd0d4546fc", "ja3_variant_count": 1, "ja3_variants": [ "967386ff0944b010a4ccd3fd0d4546fc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_373adbb9a055", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "373adbb9a055", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-10-16-35-18-13-17613-27-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788945457, "last_seen": 1788945457, "transport": "t", "ja3_hash": "fd5780ba68132b41a6077cb18eeb3e63", "ja3_variant_count": 1, "ja3_variants": [ "fd5780ba68132b41a6077cb18eeb3e63" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_5c319bfad070", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "5c319bfad070", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-11-65281-16-18-5-65037-35-17613-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788785727, "last_seen": 1788785727, "transport": "t", "ja3_hash": "00050365549057091676b3a34622b3a2", "ja3_variant_count": 1, "ja3_variants": [ "00050365549057091676b3a34622b3a2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_6d23c5bb3494", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "6d23c5bb3494", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-11-65281-35-17613-0-45-10-27-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788778483, "last_seen": 1788778483, "transport": "t", "ja3_hash": "71e89371657329227d45de94c5d7675e", "ja3_variant_count": 1, "ja3_variants": [ "71e89371657329227d45de94c5d7675e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_70cb4a7ae286", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "70cb4a7ae286", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-0-16-10-35-5-13-45-65037-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789686258, "last_seen": 1789686258, "transport": "t", "ja3_hash": "2e8a83ac0c495b9c464d46f72afe1c53", "ja3_variant_count": 1, "ja3_variants": [ "2e8a83ac0c495b9c464d46f72afe1c53" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_9947b5cfe46d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "9947b5cfe46d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-65037-10-65281-0-17613-23-18-16-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789727231, "last_seen": 1789727231, "transport": "t", "ja3_hash": "0b00c6731d9c8d68f7b60d72dfec0ed8", "ja3_variant_count": 1, "ja3_variants": [ "0b00c6731d9c8d68f7b60d72dfec0ed8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_9a44247ce8c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "9a44247ce8c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51764-18-11-10-0-17613-23-65037-13-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789123236, "last_seen": 1789123236, "transport": "t", "ja3_hash": "16b3f8ae04bde51c73c1ac0d58e14e84", "ja3_variant_count": 1, "ja3_variants": [ "16b3f8ae04bde51c73c1ac0d58e14e84" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 26 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_9ddb9e5ff7c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "9ddb9e5ff7c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-0-27-35-10-23-5-16-65281-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789022292, "last_seen": 1789022292, "transport": "t", "ja3_hash": "b8d334d22d00f63bf8e6fd1aaae86585", "ja3_variant_count": 1, "ja3_variants": [ "b8d334d22d00f63bf8e6fd1aaae86585" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_b5f13c9b78b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "b5f13c9b78b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-5-16-18-11-13-45-65281-35-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789765106, "last_seen": 1789765106, "transport": "t", "ja3_hash": "93b278b345de14850883617cd691de3c", "ja3_variant_count": 1, "ja3_variants": [ "93b278b345de14850883617cd691de3c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_bde9645ef57e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "bde9645ef57e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-45-13-5-65037-23-18-35-17613-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789006041, "last_seen": 1789006041, "transport": "t", "ja3_hash": "ed2da7a4c27d4e4e82239039a5689752", "ja3_variant_count": 1, "ja3_variants": [ "ed2da7a4c27d4e4e82239039a5689752" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_c0c4d94b3b7e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "c0c4d94b3b7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-5-23-65037-65281-10-45-16-27-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789689010, "last_seen": 1789689010, "transport": "t", "ja3_hash": "aca227ceb4ae9b412fe676051b6b9fe5", "ja3_variant_count": 1, "ja3_variants": [ "aca227ceb4ae9b412fe676051b6b9fe5" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_c426f9468579", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "c426f9468579", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-5-35-65281-0-16-65037-45-11-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789689990, "last_seen": 1789689990, "transport": "t", "ja3_hash": "532d60b10cc23b6650435e793e835592", "ja3_variant_count": 1, "ja3_variants": [ "532d60b10cc23b6650435e793e835592" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_c72f1eb75fb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "c72f1eb75fb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-16-10-23-65281-35-45-18-27-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789077199, "last_seen": 1789077199, "transport": "t", "ja3_hash": "d6b074ad347c2977dad3444b631ebc40", "ja3_variant_count": 1, "ja3_variants": [ "d6b074ad347c2977dad3444b631ebc40" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_ea4c689e9819", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "ea4c689e9819", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-0-16-5-27-17613-11-35-65037-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789168945, "last_seen": 1789168945, "transport": "t", "ja3_hash": "a12ab76f8918e33d1b3d683f2649a5bd", "ja3_variant_count": 1, "ja3_variants": [ "a12ab76f8918e33d1b3d683f2649a5bd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512ht_8daaf6152771_238ec66d5a16", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512ht", "b": "8daaf6152771", "c": "238ec66d5a16", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-5-18-16-27-0-13-35-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788828317, "last_seen": 1788828317, "transport": "t", "ja3_hash": "4f6d32b3672413e6c4cd1c27001cdd56", "ja3_variant_count": 1, "ja3_variants": [ "4f6d32b3672413e6c4cd1c27001cdd56" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512ht_8daaf6152771_576810898ff7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512ht", "b": "8daaf6152771", "c": "576810898ff7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-23-16-35-11-5-13-65037-0-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788828087, "last_seen": 1788828087, "transport": "t", "ja3_hash": "969d577caea398a902b555419739c1c6", "ja3_variant_count": 1, "ja3_variants": [ "969d577caea398a902b555419739c1c6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512ht_8daaf6152771_630a4c4fd8c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512ht", "b": "8daaf6152771", "c": "630a4c4fd8c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-11-16-18-0-65037-5-23-13-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788866124, "last_seen": 1788866124, "transport": "t", "ja3_hash": "16003ddedc2164104924fcf069129c9b", "ja3_variant_count": 1, "ja3_variants": [ "16003ddedc2164104924fcf069129c9b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512ht_8daaf6152771_a6ed037effff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512ht", "b": "8daaf6152771", "c": "a6ed037effff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-27-45-13-0-16-10-5-23-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789966277, "last_seen": 1789966277, "transport": "t", "ja3_hash": "3a5d19bc090d60e21cdb2735eb11c6e7", "ja3_variant_count": 1, "ja3_variants": [ "3a5d19bc090d60e21cdb2735eb11c6e7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_8f36eae60f75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "8f36eae60f75", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-27-18-13-23-11-35-45-0-65281-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788802223, "last_seen": 1788802223, "transport": "t", "ja3_hash": "b7632eb8ebe2f870af3762b9cac91daa", "ja3_variant_count": 1, "ja3_variants": [ "b7632eb8ebe2f870af3762b9cac91daa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_a9ee5d76bf67", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "a9ee5d76bf67", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-5-18-65037-27-13-23-65281-0-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789444010, "last_seen": 1789444010, "transport": "t", "ja3_hash": "aa948429f43a7c0c2bf41f8ced6ff98e", "ja3_variant_count": 1, "ja3_variants": [ "aa948429f43a7c0c2bf41f8ced6ff98e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_d28aec9cdf66", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "d28aec9cdf66", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-11-18-17613-35-13-51764-65037-45-10-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789802673, "last_seen": 1789802673, "transport": "t", "ja3_hash": "049f1c5ac8dbe690821fb9146d778923", "ja3_variant_count": 1, "ja3_variants": [ "049f1c5ac8dbe690821fb9146d778923" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_06a10152f8a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "06a10152f8a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-11-16-0-13-35-10-65281-45-18-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508429, "last_seen": 1788508429, "transport": "t", "ja3_hash": "e597622c390254be5e20b26f7fc0082b", "ja3_variant_count": 1, "ja3_variants": [ "e597622c390254be5e20b26f7fc0082b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_0fa377d9724a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "0fa377d9724a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-13-10-11-45-35-18-0-16-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788825898, "last_seen": 1788825898, "transport": "t", "ja3_hash": "2f3cf6432ec089939095139665e2ae1a", "ja3_variant_count": 1, "ja3_variants": [ "2f3cf6432ec089939095139665e2ae1a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_301a7f33a1d6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "301a7f33a1d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-0-11-13-17613-5-65281-65037-16-10-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789680469, "last_seen": 1789680469, "transport": "t", "ja3_hash": "2f18b9256a40489bbf9f6e7545886f0b", "ja3_variant_count": 1, "ja3_variants": [ "2f18b9256a40489bbf9f6e7545886f0b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_7cf5762362ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "7cf5762362ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-5-27-0-11-35-17613-65037-51764-16-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789647911, "last_seen": 1789647911, "transport": "t", "ja3_hash": "341f8b81054eda40c88abb632ac0f8f7", "ja3_variant_count": 1, "ja3_variants": [ "341f8b81054eda40c88abb632ac0f8f7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_bd3a3848fdb0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "bd3a3848fdb0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-27-0-35-65037-16-5-51764-13-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789958117, "last_seen": 1789958117, "transport": "t", "ja3_hash": "c7e5da03ebc49512ca5d1974de1977ea", "ja3_variant_count": 1, "ja3_variants": [ "c7e5da03ebc49512ca5d1974de1977ea" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": true } }, { "hash": "t12d1513h2_8daaf6152771_da4309ae6ab6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "da4309ae6ab6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-35-5-18-0-65037-65281-10-13-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788773487, "last_seen": 1789949424, "transport": "t", "ja3_hash": "8fc260bc70dff9a1e7476796ee03cee4", "ja3_variant_count": 2, "ja3_variants": [ "8fc260bc70dff9a1e7476796ee03cee4", "641b8dd8dc152347abd4040e0661a73a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_df0aeff010bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "df0aeff010bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-11-5-17613-18-35-13-27-16-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789218776, "last_seen": 1789218776, "transport": "t", "ja3_hash": "f9d5a338a09634467d5f064c49e6ad1d", "ja3_variant_count": 1, "ja3_variants": [ "f9d5a338a09634467d5f064c49e6ad1d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513ht_8daaf6152771_88a318a13259", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513ht", "b": "8daaf6152771", "c": "88a318a13259", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-27-45-65037-23-10-5-13-11-0-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788822320, "last_seen": 1788890023, "transport": "t", "ja3_hash": "2d068939fe42bef8755018653e635111", "ja3_variant_count": 2, "ja3_variants": [ "2d068939fe42bef8755018653e635111", "68065993ad440b5916f5ca0400a9177f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1513ht_8daaf6152771_da4309ae6ab6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (da4309ae6ab6) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d1513ht", "b": "8daaf6152771", "c": "da4309ae6ab6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-0-65281-18-5-16-10-13-45-23-65037-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 7, "first_seen": 1788825511, "last_seen": 1788825528, "transport": "t", "ja3_hash": "b9595eb4f756556aacfb3f1da4fbb174", "ja3_variant_count": 1, "ja3_variants": [ "b9595eb4f756556aacfb3f1da4fbb174" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d151400_8daaf6152771_034c68a33c97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151400", "b": "8daaf6152771", "c": "034c68a33c97", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51764-17613-11-5-45-10-65281-0-13-65037-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811258, "last_seen": 1788811258, "transport": "t", "ja3_hash": "7d2b6840fd26ea732aea4be5d6635321", "ja3_variant_count": 1, "ja3_variants": [ "7d2b6840fd26ea732aea4be5d6635321" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151400_8daaf6152771_9606b17be633", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151400", "b": "8daaf6152771", "c": "9606b17be633", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-23-5-35-27-13-10-18-0-17613-65281-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789045711, "last_seen": 1789045711, "transport": "t", "ja3_hash": "d6857f91825f3569975e9220d240e47e", "ja3_variant_count": 1, "ja3_variants": [ "d6857f91825f3569975e9220d240e47e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_4e1db6c7caac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "4e1db6c7caac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-11-65281-18-10-17613-27-0-65037-35-45-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788775246, "last_seen": 1788775246, "transport": "t", "ja3_hash": "68910b09904f7659ab8c15317f324fe1", "ja3_variant_count": 1, "ja3_variants": [ "68910b09904f7659ab8c15317f324fe1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_cc487cb2d726", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "cc487cb2d726", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-11-16-18-17613-27-5-65037-13-65281-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788774548, "last_seen": 1788774548, "transport": "t", "ja3_hash": "0b453354aa8240c073b36c908c7bef9d", "ja3_variant_count": 1, "ja3_variants": [ "0b453354aa8240c073b36c908c7bef9d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_da78366a3064", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "da78366a3064", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-5-17613-11-65281-10-0-65037-35-45-16-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788730265, "last_seen": 1788730265, "transport": "t", "ja3_hash": "d2bde246f62db6c9d5cef7ab9b1c2a66", "ja3_variant_count": 1, "ja3_variants": [ "d2bde246f62db6c9d5cef7ab9b1c2a66" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_fd1280aed873", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "fd1280aed873", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-45-65281-17613-65037-35-13-27-23-10-16-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788943302, "last_seen": 1788943302, "transport": "t", "ja3_hash": "000833e71c8113d5cf1570a4a4b10c75", "ja3_variant_count": 1, "ja3_variants": [ "000833e71c8113d5cf1570a4a4b10c75" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514ht_8daaf6152771_c24a4c1957f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514ht", "b": "8daaf6152771", "c": "c24a4c1957f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-65281-35-10-27-11-23-13-18-45-16-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788826060, "last_seen": 1788864315, "transport": "t", "ja3_hash": "1a672a0e16d2a3064eeb6053b7b6072c", "ja3_variant_count": 2, "ja3_variants": [ "1a672a0e16d2a3064eeb6053b7b6072c", "097d878c398758a4b1044519db884e29" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_e6df5a95f7d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "e6df5a95f7d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-65281-45-65037-27-10-0-5-16-18-35-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788788695, "last_seen": 1789937662, "transport": "t", "ja3_hash": "bbe290414a86cf08fc46639432cb48b8", "ja3_variant_count": 2, "ja3_variants": [ "bbe290414a86cf08fc46639432cb48b8", "2218a9b69f417c38a7c3f4e9cfdf8eab" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1516h2_8daaf6152771_16ffca02f361", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1516h2", "b": "8daaf6152771", "c": "16ffca02f361", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-13-0-65281-51764-45-10-18-65037-35-16-5-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789728403, "last_seen": 1789728403, "transport": "t", "ja3_hash": "de91525e0c93fc47d6c6fd2980b8514a", "ja3_variant_count": 1, "ja3_variants": [ "de91525e0c93fc47d6c6fd2980b8514a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12d1610h2_86a278354501_4a065df55c19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1610h2", "b": "86a278354501", "c": "4a065df55c19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 16, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1788450099, "last_seen": 1789623483, "transport": "t", "ja3_hash": "fbaa1a1e4e845f7211a0ac098415e94a", "ja3_variant_count": 1, "ja3_variants": [ "fbaa1a1e4e845f7211a0ac098415e94a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 1, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 8312 }, "ua_disagreement": false } }, { "hash": "t12d1611h2_86a278354501_09c57bba7bb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1611h2", "b": "86a278354501", "c": "09c57bba7bb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 16, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 62, "first_seen": 1787463999, "last_seen": 1789849262, "transport": "t", "ja3_hash": "0f722adfce1739b8c8c0b680b6543606", "ja3_variant_count": 1, "ja3_variants": [ "0f722adfce1739b8c8c0b680b6543606" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0": 22, "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 20, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:153.0) Gecko/20100101 Firefox/153.0": 12 }, "ua_disagreement": false } }, { "hash": "t12d170300_5b57614c22b0_27e267d15e11", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d170300", "b": "5b57614c22b0", "c": "27e267d15e11", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 17, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,5-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789774509, "last_seen": 1789774509, "transport": "t", "ja3_hash": "f3391b25c34873037010ee8958aa77df", "ja3_variant_count": 1, "ja3_variants": [ "f3391b25c34873037010ee8958aa77df" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3964.90 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1709h2_5b57614c22b0_19c4b027752a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1709h2", "b": "5b57614c22b0", "c": "19c4b027752a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 17, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 46, "first_seen": 1787569177, "last_seen": 1789713237, "transport": "t", "ja3_hash": "6018cbd8d1b575a5c5cd2caf85dba92e", "ja3_variant_count": 1, "ja3_variants": [ "6018cbd8d1b575a5c5cd2caf85dba92e" ], "user_agents": { "Mozilla/5.0 (Android 10; Mobile; rv:140.0) Gecko/140.0 Firefox/140.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3521.44 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3841.60 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1710h2_5b57614c22b0_4a065df55c19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1710h2", "b": "5b57614c22b0", "c": "4a065df55c19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 17, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 80, "first_seen": 1787547176, "last_seen": 1789954145, "transport": "t", "ja3_hash": "fd9f831a986172bfdd6979a2b8839ba6", "ja3_variant_count": 1, "ja3_variants": [ "fd9f831a986172bfdd6979a2b8839ba6" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3481.96 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 30, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3565.44 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1710h2_5b57614c22b0_abcdc00e6c32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (abcdc00e6c32) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d1710h2", "b": "5b57614c22b0", "c": "abcdc00e6c32", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 17, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789366601, "last_seen": 1789366603, "transport": "t", "ja3_hash": "9829fc24416b4e637cb294ff5c7e7c1c", "ja3_variant_count": 1, "ja3_variants": [ "9829fc24416b4e637cb294ff5c7e7c1c" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d1711ht_5b57614c22b0_09c57bba7bb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1711ht", "b": "5b57614c22b0", "c": "09c57bba7bb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 17, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 118, "first_seen": 1787668189, "last_seen": 1789928309, "transport": "t", "ja3_hash": "2ad6edab91151fc85f04312c39a62027", "ja3_variant_count": 1, "ja3_variants": [ "2ad6edab91151fc85f04312c39a62027" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0": 53, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0": 6 }, "ua_disagreement": false } }, { "hash": "t12d1810h2_e8a523a41297_4a065df55c19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1810h2", "b": "e8a523a41297", "c": "4a065df55c19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 182, "first_seen": 1787706307, "last_seen": 1788610448, "transport": "t", "ja3_hash": "ad287ce5cc6a0032b1ea59066c13f671", "ja3_variant_count": 1, "ja3_variants": [ "ad287ce5cc6a0032b1ea59066c13f671" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 11115 }, "ua_disagreement": false } }, { "hash": "t12d1811h2_e8a523a41297_09c57bba7bb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1811h2", "b": "e8a523a41297", "c": "09c57bba7bb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 88, "first_seen": 1787588566, "last_seen": 1788633163, "transport": "t", "ja3_hash": "e60d029eb5e97304e8aa6aaab1090b83", "ja3_variant_count": 1, "ja3_variants": [ "e60d029eb5e97304e8aa6aaab1090b83" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 7379 }, "ua_disagreement": false } }, { "hash": "t12d2010h2_a09f3c656075_fdfedcf8c354", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d2010h2", "b": "a09f3c656075", "c": "fdfedcf8c354", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 20, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 96, "first_seen": 1787488752, "last_seen": 1789651013, "transport": "t", "ja3_hash": "eb9b1be313ddd3f1cbbdb89f6efbc784", "ja3_variant_count": 1, "ja3_variants": [ "eb9b1be313ddd3f1cbbdb89f6efbc784" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1": 48, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Safari/605.1.15": 67, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) EdgiOS/151.0.4129.72 Version/26.0 Mobile/15E148 Safari/604.1": 69 }, "ua_disagreement": false } }, { "hash": "t12i150100_8daaf6152771_d57af3c6d519", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150100", "b": "8daaf6152771", "c": "d57af3c6d519", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 1, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 102, "first_seen": 1787448802, "last_seen": 1789967027, "transport": "t", "ja3_hash": "89cab90f953fb5d2c8103af10c53d7c3", "ja3_variant_count": 1, "ja3_variants": [ "89cab90f953fb5d2c8103af10c53d7c3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://bytedance.sg.larkoffice.com/docx/K5bxdypulop3IIxrJb0lO": 9, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 64, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_1d37bdd44634", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "1d37bdd44634", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 10, "first_seen": 1787772279, "last_seen": 1789811481, "transport": "t", "ja3_hash": "f1eb9d462739cb2a7fd531dcb55943a6", "ja3_variant_count": 1, "ja3_variants": [ "f1eb9d462739cb2a7fd531dcb55943a6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 11, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 3 }, "ua_disagreement": true } }, { "hash": "t12i150200_8daaf6152771_200cea0bc636", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "200cea0bc636", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 9, "first_seen": 1787674301, "last_seen": 1789889249, "transport": "t", "ja3_hash": "c513353fe49c78206e817738081a86ae", "ja3_variant_count": 1, "ja3_variants": [ "c513353fe49c78206e817738081a86ae" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 13, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 6 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_2d8ee407ef00", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "2d8ee407ef00", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788764161, "last_seen": 1789683995, "transport": "t", "ja3_hash": "0b43f677cafd1fed1c913bde73bb8314", "ja3_variant_count": 1, "ja3_variants": [ "0b43f677cafd1fed1c913bde73bb8314" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_73956c55d638", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "73956c55d638", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 11, "first_seen": 1788336881, "last_seen": 1789929489, "transport": "t", "ja3_hash": "4aa935ec65fdd495c81cbaeac2499901", "ja3_variant_count": 1, "ja3_variants": [ "4aa935ec65fdd495c81cbaeac2499901" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_98761281d3c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "98761281d3c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787783225, "last_seen": 1789699510, "transport": "t", "ja3_hash": "3000731ddca698cd45570d7f24243a75", "ja3_variant_count": 1, "ja3_variants": [ "3000731ddca698cd45570d7f24243a75" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_9cfa503a6a65", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "9cfa503a6a65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 7, "first_seen": 1787936460, "last_seen": 1789730788, "transport": "t", "ja3_hash": "dc62e70463eaa12e9929acaf15dc68c1", "ja3_variant_count": 1, "ja3_variants": [ "dc62e70463eaa12e9929acaf15dc68c1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_b2316c06389a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "b2316c06389a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1788006869, "last_seen": 1789654809, "transport": "t", "ja3_hash": "1b1ceaa7d1c8c7d106122fe45364338b", "ja3_variant_count": 1, "ja3_variants": [ "1b1ceaa7d1c8c7d106122fe45364338b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 10, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 10 }, "ua_disagreement": true } }, { "hash": "t12i150200_8daaf6152771_c798d119e9f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "c798d119e9f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787818320, "last_seen": 1789811988, "transport": "t", "ja3_hash": "953d501e7688dcc5c70dfa80cdfb910c", "ja3_variant_count": 1, "ja3_variants": [ "953d501e7688dcc5c70dfa80cdfb910c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_c899f8114fe8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "c899f8114fe8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 29, "first_seen": 1787461478, "last_seen": 1789882129, "transport": "t", "ja3_hash": "9e1503afa013a12182c5d11ea5aa892a", "ja3_variant_count": 2, "ja3_variants": [ "9e1503afa013a12182c5d11ea5aa892a", "0fec841b4a5645ac9d03c358c060ed58" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 30, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_d1444cee9603", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "d1444cee9603", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787660712, "last_seen": 1789584000, "transport": "t", "ja3_hash": "5a8d281390ebb1805ba0d824d6da6dca", "ja3_variant_count": 1, "ja3_variants": [ "5a8d281390ebb1805ba0d824d6da6dca" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_e1cadbf12fd7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "e1cadbf12fd7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 8, "first_seen": 1788345457, "last_seen": 1789637107, "transport": "t", "ja3_hash": "5b43de1c4f53f7d48e3fb4939d56871d", "ja3_variant_count": 1, "ja3_variants": [ "5b43de1c4f53f7d48e3fb4939d56871d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) WorkBuddy/5.5.3 Chrome/138.0.7204.251 Electron/37.10.3 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_f0f99180c131", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "f0f99180c131", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1788533529, "last_seen": 1789007303, "transport": "t", "ja3_hash": "ff19204ce1872ddbee45cef90e5a9a56", "ja3_variant_count": 2, "ja3_variants": [ "ff19204ce1872ddbee45cef90e5a9a56", "3ba164134aec11f91acfc10662c2f49c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_f21aec6009d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "f21aec6009d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1787693382, "last_seen": 1789414881, "transport": "t", "ja3_hash": "4feb8af7b0168bce91763b1a2003306a", "ja3_variant_count": 1, "ja3_variants": [ "4feb8af7b0168bce91763b1a2003306a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 20 }, "ua_disagreement": false } }, { "hash": "t12i1502h2_8daaf6152771_62ea8037d6b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1502h2", "b": "8daaf6152771", "c": "62ea8037d6b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1787847895, "last_seen": 1789730620, "transport": "t", "ja3_hash": "f647134690d16ea277d1940f6d10ec9b", "ja3_variant_count": 1, "ja3_variants": [ "f647134690d16ea277d1940f6d10ec9b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_0dcb31cc573b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "0dcb31cc573b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788362963, "last_seen": 1788838437, "transport": "t", "ja3_hash": "0d3d5e345622da4806b302fe98d6f6ff", "ja3_variant_count": 1, "ja3_variants": [ "0d3d5e345622da4806b302fe98d6f6ff" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_0f31f4e7d228", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "0f31f4e7d228", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788656785, "last_seen": 1789755819, "transport": "t", "ja3_hash": "0176e24cd2d89bf72337547d90c9319c", "ja3_variant_count": 1, "ja3_variants": [ "0176e24cd2d89bf72337547d90c9319c" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_0fbbb947d549", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "0fbbb947d549", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789656671, "last_seen": 1789656671, "transport": "t", "ja3_hash": "50013c0836f7ae34d9e5bbdf60a7df14", "ja3_variant_count": 1, "ja3_variants": [ "50013c0836f7ae34d9e5bbdf60a7df14" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_0fd8f24c059b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "0fd8f24c059b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789703313, "last_seen": 1789703313, "transport": "t", "ja3_hash": "9af6b539c6edf5472f03b65eec31c87b", "ja3_variant_count": 1, "ja3_variants": [ "9af6b539c6edf5472f03b65eec31c87b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_14b108ac7c7c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "14b108ac7c7c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788776671, "last_seen": 1789880362, "transport": "t", "ja3_hash": "d4cc8f57869e6a687ebeffe64d875cd6", "ja3_variant_count": 2, "ja3_variants": [ "d4cc8f57869e6a687ebeffe64d875cd6", "63b2057f92863ba3efb908057d5cf677" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_20608c9b2484", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "20608c9b2484", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788962463, "last_seen": 1789929003, "transport": "t", "ja3_hash": "a4790fb972cb1d02ad91e3e2ed7cacc5", "ja3_variant_count": 2, "ja3_variants": [ "a4790fb972cb1d02ad91e3e2ed7cacc5", "bc3f8989254263cee9f52da4bdf3390c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (iPad; CPU OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_243a59383c1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "243a59383c1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788811879, "last_seen": 1788811879, "transport": "t", "ja3_hash": "c0ab34aa3edec978d375f7aa75fd326a", "ja3_variant_count": 1, "ja3_variants": [ "c0ab34aa3edec978d375f7aa75fd326a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_2aa3faa7b11f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "2aa3faa7b11f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789029051, "last_seen": 1789029051, "transport": "t", "ja3_hash": "5218cd15fbb9d6c726e5ea766f8d0476", "ja3_variant_count": 1, "ja3_variants": [ "5218cd15fbb9d6c726e5ea766f8d0476" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_2c7b8162415f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "2c7b8162415f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789451921, "last_seen": 1789702109, "transport": "t", "ja3_hash": "de04263c7e60e892459b04fef4eed9d7", "ja3_variant_count": 2, "ja3_variants": [ "de04263c7e60e892459b04fef4eed9d7", "f3b6ebded141b6d26fe3d92e0520c28e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_2e2b5e26d20b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "2e2b5e26d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789028284, "last_seen": 1789028284, "transport": "t", "ja3_hash": "7430343282e1363a12e7176cc8b21194", "ja3_variant_count": 1, "ja3_variants": [ "7430343282e1363a12e7176cc8b21194" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_33fe7f58ec7d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "33fe7f58ec7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789649877, "last_seen": 1789649877, "transport": "t", "ja3_hash": "897962bd7c702c7d4d62bbdda0d115b2", "ja3_variant_count": 1, "ja3_variants": [ "897962bd7c702c7d4d62bbdda0d115b2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_3dded7a9aad6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "3dded7a9aad6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789587737, "last_seen": 1789587737, "transport": "t", "ja3_hash": "e0caf4e5edf2d724fbdc317e54c4f36b", "ja3_variant_count": 1, "ja3_variants": [ "e0caf4e5edf2d724fbdc317e54c4f36b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_40aa50c61343", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "40aa50c61343", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1788849170, "last_seen": 1789778649, "transport": "t", "ja3_hash": "5f41f7e7f9e38749a4b5581baafec9eb", "ja3_variant_count": 3, "ja3_variants": [ "5f41f7e7f9e38749a4b5581baafec9eb", "65d33b6f18c16a9e78a91345f577eaa5", "bfaf0473060983100f49d2c333b8467c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_5cbb9ad5c6b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "5cbb9ad5c6b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788844392, "last_seen": 1788844392, "transport": "t", "ja3_hash": "ed16cf74c4a9faefdbdcaf29305ff2f9", "ja3_variant_count": 1, "ja3_variants": [ "ed16cf74c4a9faefdbdcaf29305ff2f9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_60d39bbf57b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "60d39bbf57b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787892673, "last_seen": 1789754323, "transport": "t", "ja3_hash": "20a0f8161eff117796a517d7fad2de0c", "ja3_variant_count": 2, "ja3_variants": [ "20a0f8161eff117796a517d7fad2de0c", "da7974d09789764ce63574abd6229be0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_61b38f058b9c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "61b38f058b9c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788454620, "last_seen": 1789963682, "transport": "t", "ja3_hash": "62fbd475d772346b2b9012dac4e57171", "ja3_variant_count": 2, "ja3_variants": [ "62fbd475d772346b2b9012dac4e57171", "04ff28f7af5f638fa1950927ce47e83f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_63c1024017c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "63c1024017c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789403476, "last_seen": 1789454942, "transport": "t", "ja3_hash": "47385c5d6a33cbdbcff7725be1276aa0", "ja3_variant_count": 3, "ja3_variants": [ "47385c5d6a33cbdbcff7725be1276aa0", "3adc0a2a25e88c430323da5b49745b63", "4893de106d74172b08188a79f38b41cd" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_69f0ea65a575", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "69f0ea65a575", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788760123, "last_seen": 1789950060, "transport": "t", "ja3_hash": "61f5979e7a243b5a95da0c9bd4182081", "ja3_variant_count": 2, "ja3_variants": [ "61f5979e7a243b5a95da0c9bd4182081", "ac8770c370691d0603e59b3c6c480b6a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12i150300_8daaf6152771_703600d2ceac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "703600d2ceac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788814093, "last_seen": 1789895929, "transport": "t", "ja3_hash": "faecdb5a8eee442973499e5beeb0c92c", "ja3_variant_count": 2, "ja3_variants": [ "faecdb5a8eee442973499e5beeb0c92c", "10a6b5981dd3d01d1a84a91d9feeb302" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_72eff015c141", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "72eff015c141", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788888589, "last_seen": 1788888589, "transport": "t", "ja3_hash": "a9a237393a348e8b02140537b64b47e0", "ja3_variant_count": 1, "ja3_variants": [ "a9a237393a348e8b02140537b64b47e0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_731509cc7d31", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "731509cc7d31", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788795823, "last_seen": 1789701507, "transport": "t", "ja3_hash": "2f2b9562ebc8910f9124a7ebd7440c6f", "ja3_variant_count": 1, "ja3_variants": [ "2f2b9562ebc8910f9124a7ebd7440c6f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_7b821b73213e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "7b821b73213e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789928938, "last_seen": 1789928938, "transport": "t", "ja3_hash": "11bfe54a8fad87622e024ca17f9cfc10", "ja3_variant_count": 1, "ja3_variants": [ "11bfe54a8fad87622e024ca17f9cfc10" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_80a9c4ead107", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "80a9c4ead107", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789966939, "last_seen": 1789966939, "transport": "t", "ja3_hash": "8d95ba02d541805b8c66004e90fac836", "ja3_variant_count": 1, "ja3_variants": [ "8d95ba02d541805b8c66004e90fac836" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_855532499de1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "855532499de1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789690170, "last_seen": 1789690170, "transport": "t", "ja3_hash": "c86f97a3cd63cec0205474ab53a6c2a9", "ja3_variant_count": 1, "ja3_variants": [ "c86f97a3cd63cec0205474ab53a6c2a9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_861dbf3f9010", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "861dbf3f9010", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789016262, "last_seen": 1789366472, "transport": "t", "ja3_hash": "6886911bd59ad4920e6f72c544d2a330", "ja3_variant_count": 2, "ja3_variants": [ "6886911bd59ad4920e6f72c544d2a330", "cac52c5064fe35a9550ed8015bea939a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 25, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_8834694faa50", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "8834694faa50", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788840756, "last_seen": 1788840756, "transport": "t", "ja3_hash": "40128253aba90aaf48af68c83122762d", "ja3_variant_count": 1, "ja3_variants": [ "40128253aba90aaf48af68c83122762d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_889fca618af4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "889fca618af4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789776266, "last_seen": 1789776266, "transport": "t", "ja3_hash": "5c0b982025c9fbc06bb7f3727de15bea", "ja3_variant_count": 1, "ja3_variants": [ "5c0b982025c9fbc06bb7f3727de15bea" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.2006.60 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_8cc308a53a60", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "8cc308a53a60", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787678252, "last_seen": 1789643460, "transport": "t", "ja3_hash": "e4fda925e15c38d16aa6050457dfd93d", "ja3_variant_count": 2, "ja3_variants": [ "e4fda925e15c38d16aa6050457dfd93d", "9c66ebe73048bc69dbd8baed51223938" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_93de4125407b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "93de4125407b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839687, "last_seen": 1788839687, "transport": "t", "ja3_hash": "a05dfc505b1ac9113c3fb1a57eae2855", "ja3_variant_count": 1, "ja3_variants": [ "a05dfc505b1ac9113c3fb1a57eae2855" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_9ae86f3248c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "9ae86f3248c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788302912, "last_seen": 1788795121, "transport": "t", "ja3_hash": "ebbe322c5d34babf52a3ced1fe18074f", "ja3_variant_count": 1, "ja3_variants": [ "ebbe322c5d34babf52a3ced1fe18074f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_9f9a6f207792", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "9f9a6f207792", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788684408, "last_seen": 1789920887, "transport": "t", "ja3_hash": "5894f9f4efe1795df774d453960b395c", "ja3_variant_count": 2, "ja3_variants": [ "5894f9f4efe1795df774d453960b395c", "c3cd97d282d8143573ebe6748d4976d7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_a537042d8382", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "a537042d8382", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788509353, "last_seen": 1789218778, "transport": "t", "ja3_hash": "e62ab1c99a28aa5d847ee6b967fd6ce2", "ja3_variant_count": 2, "ja3_variants": [ "e62ab1c99a28aa5d847ee6b967fd6ce2", "ee378854005883e4ad42bcbb7e235b64" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 9 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_a8dac5311dfa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "a8dac5311dfa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789224360, "last_seen": 1789224360, "transport": "t", "ja3_hash": "d8572d5b5b20461fa0e7448b0d546ad8", "ja3_variant_count": 1, "ja3_variants": [ "d8572d5b5b20461fa0e7448b0d546ad8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_b1ffd1df4799", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "b1ffd1df4799", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788336576, "last_seen": 1789158360, "transport": "t", "ja3_hash": "6c2b8bdc9e9ea58091e6fd191d951713", "ja3_variant_count": 1, "ja3_variants": [ "6c2b8bdc9e9ea58091e6fd191d951713" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 3 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_c4fe6519c741", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "c4fe6519c741", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788887731, "last_seen": 1788887731, "transport": "t", "ja3_hash": "7f792a943a1114a65a71d3d9c7ec67a2", "ja3_variant_count": 1, "ja3_variants": [ "7f792a943a1114a65a71d3d9c7ec67a2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_c59844a9907e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "c59844a9907e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788900223, "last_seen": 1788900223, "transport": "t", "ja3_hash": "a96f4dc9e173e20640413dbb1d668579", "ja3_variant_count": 1, "ja3_variants": [ "a96f4dc9e173e20640413dbb1d668579" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_c8afba213708", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "c8afba213708", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788455449, "last_seen": 1788455449, "transport": "t", "ja3_hash": "883de831507a53e07fafb82f7a77cea9", "ja3_variant_count": 1, "ja3_variants": [ "883de831507a53e07fafb82f7a77cea9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_c8c3180d45da", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "c8c3180d45da", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788723901, "last_seen": 1789750048, "transport": "t", "ja3_hash": "c3a7cccf2f33762db19947620aa6be0b", "ja3_variant_count": 2, "ja3_variants": [ "c3a7cccf2f33762db19947620aa6be0b", "3ff04446ef491952db8cd4c0ca5ac28f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_cb25bfb5baed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "cb25bfb5baed", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788491915, "last_seen": 1788837836, "transport": "t", "ja3_hash": "d555db7b308307e54365d6b33ca81817", "ja3_variant_count": 1, "ja3_variants": [ "d555db7b308307e54365d6b33ca81817" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_df9b888d714f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "df9b888d714f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789235410, "last_seen": 1789584398, "transport": "t", "ja3_hash": "e7400a4b1c310b90456b5eda25c59cfe", "ja3_variant_count": 1, "ja3_variants": [ "e7400a4b1c310b90456b5eda25c59cfe" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_e36c1c2b7877", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "e36c1c2b7877", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787811210, "last_seen": 1789889717, "transport": "t", "ja3_hash": "8366ba1af275ca99a31f4f5b130d9b49", "ja3_variant_count": 2, "ja3_variants": [ "8366ba1af275ca99a31f4f5b130d9b49", "217135339d3513b134b8501ec4b8ad49" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12i150300_8daaf6152771_ead02e0fa6fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "ead02e0fa6fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789043646, "last_seen": 1789043646, "transport": "t", "ja3_hash": "ba27fa782d33e8fb14318fe47b34855a", "ja3_variant_count": 1, "ja3_variants": [ "ba27fa782d33e8fb14318fe47b34855a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_ef3e93476692", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "ef3e93476692", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789315751, "last_seen": 1789315751, "transport": "t", "ja3_hash": "32a061f615a197798deaaed1b2391dbb", "ja3_variant_count": 1, "ja3_variants": [ "32a061f615a197798deaaed1b2391dbb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 9 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_243a59383c1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "243a59383c1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788596000, "last_seen": 1788596000, "transport": "t", "ja3_hash": "0519941e6e5ab049fbeb14278b587ca5", "ja3_variant_count": 1, "ja3_variants": [ "0519941e6e5ab049fbeb14278b587ca5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 7 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_29fb568ecb96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "29fb568ecb96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789027760, "last_seen": 1789027760, "transport": "t", "ja3_hash": "86ec0efa22e82831b3e92206bb06a5ec", "ja3_variant_count": 1, "ja3_variants": [ "86ec0efa22e82831b3e92206bb06a5ec" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; SM-S938B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_389b9922d8cc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "389b9922d8cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788723971, "last_seen": 1789591743, "transport": "t", "ja3_hash": "7e34917d199bfde07baa0a3e7479e1ae", "ja3_variant_count": 3, "ja3_variants": [ "7e34917d199bfde07baa0a3e7479e1ae", "fa398326ec898809da57e8ab38047a10", "e2336bd31319d9fe69834ab675f1762a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_baf0a4827efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "baf0a4827efd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789026294, "last_seen": 1789026294, "transport": "t", "ja3_hash": "5118538a5f3abf1a829fc23f6f7acf3c", "ja3_variant_count": 1, "ja3_variants": [ "5118538a5f3abf1a829fc23f6f7acf3c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 10 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_cd15ef09578c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "cd15ef09578c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787963045, "last_seen": 1789654109, "transport": "t", "ja3_hash": "f08ec4ce4feea1cb140842fa3f9e4353", "ja3_variant_count": 2, "ja3_variants": [ "f08ec4ce4feea1cb140842fa3f9e4353", "adcf03159d1b9726318c6d268c6c9a6f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1503ht_8daaf6152771_5983db0d0827", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503ht", "b": "8daaf6152771", "c": "5983db0d0827", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789623477, "last_seen": 1789623477, "transport": "t", "ja3_hash": "56ad4bc18c379d14cc97b2f46f41508b", "ja3_variant_count": 1, "ja3_variants": [ "56ad4bc18c379d14cc97b2f46f41508b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_066c99c0c318", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "066c99c0c318", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788688168, "last_seen": 1788688168, "transport": "t", "ja3_hash": "57505b7d37aaff93681f7c5f4605a5cd", "ja3_variant_count": 1, "ja3_variants": [ "57505b7d37aaff93681f7c5f4605a5cd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 3 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_0f6d8317e58b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "0f6d8317e58b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789028398, "last_seen": 1789028398, "transport": "t", "ja3_hash": "82eb39d029deb853f08978526881774d", "ja3_variant_count": 1, "ja3_variants": [ "82eb39d029deb853f08978526881774d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_23c0ddd8235e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "23c0ddd8235e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788948589, "last_seen": 1789629409, "transport": "t", "ja3_hash": "d3d61e2533da8d7fe72b08f6409735b8", "ja3_variant_count": 2, "ja3_variants": [ "d3d61e2533da8d7fe72b08f6409735b8", "4bfaf1767ab8d005a095a4ac15a32636" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_2c23c1e9a828", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "2c23c1e9a828", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788811167, "last_seen": 1789215731, "transport": "t", "ja3_hash": "c9e25406f735054bc0fe3d25789ea428", "ja3_variant_count": 2, "ja3_variants": [ "c9e25406f735054bc0fe3d25789ea428", "6fc32b9d567ad7060c9d31e7677bfff7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_2ce2910c0600", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "2ce2910c0600", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788617533, "last_seen": 1788617533, "transport": "t", "ja3_hash": "8b91d87918b4be7c1b346eb1a650e615", "ja3_variant_count": 1, "ja3_variants": [ "8b91d87918b4be7c1b346eb1a650e615" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_2fddc85497ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "2fddc85497ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788465641, "last_seen": 1788465641, "transport": "t", "ja3_hash": "7f44fa82e8468a23c74f2093724aad48", "ja3_variant_count": 1, "ja3_variants": [ "7f44fa82e8468a23c74f2093724aad48" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_3a85a3548166", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "3a85a3548166", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788743658, "last_seen": 1788743658, "transport": "t", "ja3_hash": "20df95d6f5863d455e6391288a6da45f", "ja3_variant_count": 1, "ja3_variants": [ "20df95d6f5863d455e6391288a6da45f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_3b7fdc9f0fa5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "3b7fdc9f0fa5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-27-23,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788767889, "last_seen": 1788829274, "transport": "t", "ja3_hash": "ab54981e30c3587cbb44d25d53c7889c", "ja3_variant_count": 2, "ja3_variants": [ "ab54981e30c3587cbb44d25d53c7889c", "9c638315722279865991f616f2ea801a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_40e2c5e20574", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "40e2c5e20574", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788762524, "last_seen": 1788762524, "transport": "t", "ja3_hash": "8e6cf054fd2a7d2208b07a16c7e5afb0", "ja3_variant_count": 1, "ja3_variants": [ "8e6cf054fd2a7d2208b07a16c7e5afb0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_413202455ff3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "413202455ff3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789655111, "last_seen": 1789655111, "transport": "t", "ja3_hash": "50acfa7bf298c10f6ef56bf24b3ff291", "ja3_variant_count": 1, "ja3_variants": [ "50acfa7bf298c10f6ef56bf24b3ff291" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 85 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_44b98863c7ea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "44b98863c7ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669089, "last_seen": 1789669089, "transport": "t", "ja3_hash": "38aed29e84564bb0a2e489453d906421", "ja3_variant_count": 1, "ja3_variants": [ "38aed29e84564bb0a2e489453d906421" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_484018c9ef8e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "484018c9ef8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789967070, "last_seen": 1789967070, "transport": "t", "ja3_hash": "118327686f66026aee2adfb50985dd00", "ja3_variant_count": 1, "ja3_variants": [ "118327686f66026aee2adfb50985dd00" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_55d5deed8759", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "55d5deed8759", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789683860, "last_seen": 1789683860, "transport": "t", "ja3_hash": "74fb2bd8495d1cb480a031805e3edb02", "ja3_variant_count": 1, "ja3_variants": [ "74fb2bd8495d1cb480a031805e3edb02" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_56064a233722", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "56064a233722", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-51-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789637782, "last_seen": 1789637782, "transport": "t", "ja3_hash": "be139d93b38ae65ff7261d3d05f2497c", "ja3_variant_count": 1, "ja3_variants": [ "be139d93b38ae65ff7261d3d05f2497c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_5f64d2fa02cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "5f64d2fa02cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788827382, "last_seen": 1788827382, "transport": "t", "ja3_hash": "f9eee47498083bec44734c548a7f3053", "ja3_variant_count": 1, "ja3_variants": [ "f9eee47498083bec44734c548a7f3053" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_638c44a6fd4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "638c44a6fd4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789641616, "last_seen": 1789641616, "transport": "t", "ja3_hash": "007fe7790c40963b86857d540fc40b7e", "ja3_variant_count": 1, "ja3_variants": [ "007fe7790c40963b86857d540fc40b7e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_6ae0f3e02dd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "6ae0f3e02dd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-51-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788837005, "last_seen": 1788837005, "transport": "t", "ja3_hash": "1abd2f63d2064c4b02e93756f4371ca1", "ja3_variant_count": 1, "ja3_variants": [ "1abd2f63d2064c4b02e93756f4371ca1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_6bc12052a735", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "6bc12052a735", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788899958, "last_seen": 1788899958, "transport": "t", "ja3_hash": "26823b5b2496a544b05e8db84814fb39", "ja3_variant_count": 1, "ja3_variants": [ "26823b5b2496a544b05e8db84814fb39" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 22 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_6f39ef6c591d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "6f39ef6c591d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789240532, "last_seen": 1789240532, "transport": "t", "ja3_hash": "dd2c54e3bfaeb185efccd3755358c022", "ja3_variant_count": 1, "ja3_variants": [ "dd2c54e3bfaeb185efccd3755358c022" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_8116f3cf52d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "8116f3cf52d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-65281-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788773233, "last_seen": 1788773233, "transport": "t", "ja3_hash": "a394ecba66f626577a53dba5fdf3156e", "ja3_variant_count": 1, "ja3_variants": [ "a394ecba66f626577a53dba5fdf3156e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_891ee51b43ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "891ee51b43ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788973158, "last_seen": 1789830225, "transport": "t", "ja3_hash": "c7d59c92a768b66dbd5e8c87168d8acf", "ja3_variant_count": 4, "ja3_variants": [ "c7d59c92a768b66dbd5e8c87168d8acf", "6c047de79257740bc291d9dfd7588218", "57db0146f5adcd0334d7a9ab7526a951", "ac9940d2c21d34e63da1675a24d87cd1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a23738d3380f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a23738d3380f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-51-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788822430, "last_seen": 1788822430, "transport": "t", "ja3_hash": "21b6e46ff0e4ead3582857f8ecfcf98b", "ja3_variant_count": 1, "ja3_variants": [ "21b6e46ff0e4ead3582857f8ecfcf98b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a6ecbde58d5f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a6ecbde58d5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789763235, "last_seen": 1789763235, "transport": "t", "ja3_hash": "4b15e0ee71596ae3a90707106d85ad60", "ja3_variant_count": 1, "ja3_variants": [ "4b15e0ee71596ae3a90707106d85ad60" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.2890.48 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_aae3ce536500", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "aae3ce536500", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-13-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789008984, "last_seen": 1789008984, "transport": "t", "ja3_hash": "027c87e4d13aee0657f4c6b6f71b2e58", "ja3_variant_count": 1, "ja3_variants": [ "027c87e4d13aee0657f4c6b6f71b2e58" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_ab3af0cd00f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "ab3af0cd00f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788824151, "last_seen": 1789688812, "transport": "t", "ja3_hash": "756c8ddb21f58c5ebe94f3d0f0f4f627", "ja3_variant_count": 2, "ja3_variants": [ "756c8ddb21f58c5ebe94f3d0f0f4f627", "d01e30f31c5161c9fcd39af263edc4a5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_ab3ffa0ddc4a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "ab3ffa0ddc4a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789061252, "last_seen": 1789061252, "transport": "t", "ja3_hash": "5d98c244ae073005e23bf63ecc3bcf17", "ja3_variant_count": 1, "ja3_variants": [ "5d98c244ae073005e23bf63ecc3bcf17" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b11ae3ce6a3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b11ae3ce6a3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-45-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789889718, "last_seen": 1789889718, "transport": "t", "ja3_hash": "06c3ace3e714c9e251100496159dbcfb", "ja3_variant_count": 1, "ja3_variants": [ "06c3ace3e714c9e251100496159dbcfb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b21ca7f83aaf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b21ca7f83aaf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788850766, "last_seen": 1788850766, "transport": "t", "ja3_hash": "f45b8171cb773be7ac03dcd5d30566e1", "ja3_variant_count": 1, "ja3_variants": [ "f45b8171cb773be7ac03dcd5d30566e1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b3c1546c8a21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b3c1546c8a21", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789698468, "last_seen": 1789698468, "transport": "t", "ja3_hash": "04b27a8e2d4ee3276e74a45806e890f7", "ja3_variant_count": 1, "ja3_variants": [ "04b27a8e2d4ee3276e74a45806e890f7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b7ce223a8af7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b7ce223a8af7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789632089, "last_seen": 1789632089, "transport": "t", "ja3_hash": "706b067c79930da50afc789df6191f1e", "ja3_variant_count": 1, "ja3_variants": [ "706b067c79930da50afc789df6191f1e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b8d2c71dfc92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b8d2c71dfc92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788837397, "last_seen": 1789814549, "transport": "t", "ja3_hash": "90a0f3960ccfb8f85535e310b171e85b", "ja3_variant_count": 2, "ja3_variants": [ "90a0f3960ccfb8f85535e310b171e85b", "f3cd4dff7a49390f7c421fc18004c7b5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_c1902a62d122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "c1902a62d122", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 22, "first_seen": 1787631205, "last_seen": 1789700092, "transport": "t", "ja3_hash": "ff034cc7e0984b82b375d63658411b28", "ja3_variant_count": 2, "ja3_variants": [ "ff034cc7e0984b82b375d63658411b28", "976ee2c0e5a09d4fd8d81734066061ca" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3333.179 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.2059.48 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3406.83 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_c7b227b2ba90", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "c7b227b2ba90", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-23-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789146371, "last_seen": 1789146371, "transport": "t", "ja3_hash": "2372416187b15469733268d4df80e3ec", "ja3_variant_count": 1, "ja3_variants": [ "2372416187b15469733268d4df80e3ec" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_d79220568bd7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "d79220568bd7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788745078, "last_seen": 1789201600, "transport": "t", "ja3_hash": "85765313990ed4067e580508501f0afc", "ja3_variant_count": 2, "ja3_variants": [ "85765313990ed4067e580508501f0afc", "6f601476fe2d95d65ecf18a29a4cad85" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_d9ded312e17a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "d9ded312e17a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-18-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789737252, "last_seen": 1789737252, "transport": "t", "ja3_hash": "2b74c8eb39764e5e6d6e20d73f2da611", "ja3_variant_count": 1, "ja3_variants": [ "2b74c8eb39764e5e6d6e20d73f2da611" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_dab7a2f68b8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "dab7a2f68b8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-13-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024339, "last_seen": 1789024339, "transport": "t", "ja3_hash": "5127e707756325603885f1133795eef7", "ja3_variant_count": 1, "ja3_variants": [ "5127e707756325603885f1133795eef7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 28 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_df67d0944961", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "df67d0944961", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789692988, "last_seen": 1789692988, "transport": "t", "ja3_hash": "a23bdaabb95f09a8320ea66e073e1711", "ja3_variant_count": 1, "ja3_variants": [ "a23bdaabb95f09a8320ea66e073e1711" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_e2bc29c52c4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "e2bc29c52c4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788884486, "last_seen": 1788884486, "transport": "t", "ja3_hash": "c098405c883f014d891c58cfa3a91993", "ja3_variant_count": 1, "ja3_variants": [ "c098405c883f014d891c58cfa3a91993" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_f0b97db14b89", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "f0b97db14b89", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788864926, "last_seen": 1788864926, "transport": "t", "ja3_hash": "5f1f66729ad642df7a896388cf138232", "ja3_variant_count": 1, "ja3_variants": [ "5f1f66729ad642df7a896388cf138232" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_f507a823e386", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "f507a823e386", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788876092, "last_seen": 1788876092, "transport": "t", "ja3_hash": "3d7b671a8a12ce3c4967a225fc84900a", "ja3_variant_count": 1, "ja3_variants": [ "3d7b671a8a12ce3c4967a225fc84900a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_fe8352abbea0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "fe8352abbea0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789340860, "last_seen": 1789340860, "transport": "t", "ja3_hash": "c1b02e30d3dbe5b298ba0a160531f62a", "ja3_variant_count": 1, "ja3_variants": [ "c1b02e30d3dbe5b298ba0a160531f62a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_ff736ef4a661", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "ff736ef4a661", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789888331, "last_seen": 1789888331, "transport": "t", "ja3_hash": "d1f3dd872edcba69cb9b26d75fc7db99", "ja3_variant_count": 1, "ja3_variants": [ "d1f3dd872edcba69cb9b26d75fc7db99" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_0b3eaee61d21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "0b3eaee61d21", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788776159, "last_seen": 1789195043, "transport": "t", "ja3_hash": "328ba2265e5edc8b25f806a1ca4ed266", "ja3_variant_count": 2, "ja3_variants": [ "328ba2265e5edc8b25f806a1ca4ed266", "d2666ba77a4ffd44b83ad71cf2aada48" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_11fbab25dc62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "11fbab25dc62", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788806444, "last_seen": 1788806444, "transport": "t", "ja3_hash": "11ccb8e7a94e6c9a47b9423d1a358a32", "ja3_variant_count": 1, "ja3_variants": [ "11ccb8e7a94e6c9a47b9423d1a358a32" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_50fd260dc125", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "50fd260dc125", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-23-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788676900, "last_seen": 1788676900, "transport": "t", "ja3_hash": "a2c7e5896b1e199dd33f1a589e8cc718", "ja3_variant_count": 1, "ja3_variants": [ "a2c7e5896b1e199dd33f1a589e8cc718" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_6996bbacfb40", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "6996bbacfb40", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788953675, "last_seen": 1788953675, "transport": "t", "ja3_hash": "5e92008c40094395e2f2c483a7cb6224", "ja3_variant_count": 1, "ja3_variants": [ "5e92008c40094395e2f2c483a7cb6224" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_937be5dfd674", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "937be5dfd674", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788727079, "last_seen": 1788727079, "transport": "t", "ja3_hash": "0a095f2235caf67f99852c1ae6dbc413", "ja3_variant_count": 1, "ja3_variants": [ "0a095f2235caf67f99852c1ae6dbc413" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_bc33887b114f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "bc33887b114f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789638907, "last_seen": 1789638907, "transport": "t", "ja3_hash": "63185ce11127e6a7189c224da9e10580", "ja3_variant_count": 1, "ja3_variants": [ "63185ce11127e6a7189c224da9e10580" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 93 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_c0fedda59e3e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "c0fedda59e3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788989949, "last_seen": 1788989949, "transport": "t", "ja3_hash": "c98537eb3e3a9b25e9dba3a8cf0ffe40", "ja3_variant_count": 1, "ja3_variants": [ "c98537eb3e3a9b25e9dba3a8cf0ffe40" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504ht_8daaf6152771_26c34c2e03e6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504ht", "b": "8daaf6152771", "c": "26c34c2e03e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-23-65281-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788886993, "last_seen": 1788886993, "transport": "t", "ja3_hash": "45473c2799dd7f1c40b9b3c8892e345e", "ja3_variant_count": 1, "ja3_variants": [ "45473c2799dd7f1c40b9b3c8892e345e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504ht_8daaf6152771_3df7d66bf4e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504ht", "b": "8daaf6152771", "c": "3df7d66bf4e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-51-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788721265, "last_seen": 1788721265, "transport": "t", "ja3_hash": "18dd8fd5c0c76faf1159488972b39043", "ja3_variant_count": 1, "ja3_variants": [ "18dd8fd5c0c76faf1159488972b39043" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504ht_8daaf6152771_44a66c48c0a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504ht", "b": "8daaf6152771", "c": "44a66c48c0a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789877993, "last_seen": 1789877993, "transport": "t", "ja3_hash": "fe1f71b8c284d7caa4f25c09df51d81a", "ja3_variant_count": 1, "ja3_variants": [ "fe1f71b8c284d7caa4f25c09df51d81a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504ht_8daaf6152771_7cf5e729d4c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504ht", "b": "8daaf6152771", "c": "7cf5e729d4c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-5-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788844875, "last_seen": 1788844875, "transport": "t", "ja3_hash": "c5fa2330562ccc9939f6fb917580ccf1", "ja3_variant_count": 1, "ja3_variants": [ "c5fa2330562ccc9939f6fb917580ccf1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504ht_8daaf6152771_aae3ce536500", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504ht", "b": "8daaf6152771", "c": "aae3ce536500", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788826883, "last_seen": 1788826883, "transport": "t", "ja3_hash": "d2c059414aa2e9b26fd31f57648456a5", "ja3_variant_count": 1, "ja3_variants": [ "d2c059414aa2e9b26fd31f57648456a5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_00a5a810affa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "00a5a810affa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788837455, "last_seen": 1788837455, "transport": "t", "ja3_hash": "cae7fa187cbcf4284c7dd0876c682c9a", "ja3_variant_count": 1, "ja3_variants": [ "cae7fa187cbcf4284c7dd0876c682c9a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_02019dace9e5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "02019dace9e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-27-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788445204, "last_seen": 1788445204, "transport": "t", "ja3_hash": "06e4eee7d17a36570a1c57d953d78cd1", "ja3_variant_count": 1, "ja3_variants": [ "06e4eee7d17a36570a1c57d953d78cd1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_12894e370ada", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "12894e370ada", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-51764-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508427, "last_seen": 1788508427, "transport": "t", "ja3_hash": "805a7ec53cd8399dc271a1d8f181ddc4", "ja3_variant_count": 1, "ja3_variants": [ "805a7ec53cd8399dc271a1d8f181ddc4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_1635d394a76c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "1635d394a76c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-10-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789551720, "last_seen": 1789551720, "transport": "t", "ja3_hash": "45e5d7a8f8ac3869239c14ed73c4d57d", "ja3_variant_count": 1, "ja3_variants": [ "45e5d7a8f8ac3869239c14ed73c4d57d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_196596060592", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "196596060592", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-35-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788788923, "last_seen": 1788788923, "transport": "t", "ja3_hash": "c9cd54c56888bc151cb0c3017acf08af", "ja3_variant_count": 1, "ja3_variants": [ "c9cd54c56888bc151cb0c3017acf08af" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_1d3b1989452e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "1d3b1989452e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-51-10-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789678220, "last_seen": 1789678220, "transport": "t", "ja3_hash": "023ada2b77b069d4979c2e1a3f026277", "ja3_variant_count": 1, "ja3_variants": [ "023ada2b77b069d4979c2e1a3f026277" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_21755c9fc930", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "21755c9fc930", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-10-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789950628, "last_seen": 1789950628, "transport": "t", "ja3_hash": "595f930df9d862d804408f1162012db2", "ja3_variant_count": 1, "ja3_variants": [ "595f930df9d862d804408f1162012db2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_32b7e919372a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "32b7e919372a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-13-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788751432, "last_seen": 1788751432, "transport": "t", "ja3_hash": "5027e66c1c6b83fab4e0c7ed73740701", "ja3_variant_count": 1, "ja3_variants": [ "5027e66c1c6b83fab4e0c7ed73740701" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_380a2780bb20", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "380a2780bb20", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-18-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730647, "last_seen": 1789730647, "transport": "t", "ja3_hash": "94fd96e541190189cca49ee5fe056f01", "ja3_variant_count": 1, "ja3_variants": [ "94fd96e541190189cca49ee5fe056f01" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_3868ac5b9628", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "3868ac5b9628", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-23-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789753041, "last_seen": 1789753041, "transport": "t", "ja3_hash": "5245f9cbf3c3ce5da22f0867f53d951e", "ja3_variant_count": 1, "ja3_variants": [ "5245f9cbf3c3ce5da22f0867f53d951e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_39324acfbe15", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "39324acfbe15", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-5-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788867993, "last_seen": 1788867993, "transport": "t", "ja3_hash": "0864775a6594b2819e781afca22fd375", "ja3_variant_count": 1, "ja3_variants": [ "0864775a6594b2819e781afca22fd375" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_4861b6a7afe3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "4861b6a7afe3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789068109, "last_seen": 1789068109, "transport": "t", "ja3_hash": "bdcb099a2fc55585ce51b41d35545aae", "ja3_variant_count": 1, "ja3_variants": [ "bdcb099a2fc55585ce51b41d35545aae" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 3 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_62532abf2480", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "62532abf2480", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-5-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789686528, "last_seen": 1789686528, "transport": "t", "ja3_hash": "a129cb80c4d9dacd1b6f3016b27f7a57", "ja3_variant_count": 1, "ja3_variants": [ "a129cb80c4d9dacd1b6f3016b27f7a57" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_660e77fdb33a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "660e77fdb33a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789100525, "last_seen": 1789100525, "transport": "t", "ja3_hash": "2224f6aab636c4ba6c7fd4f51a20ebd8", "ja3_variant_count": 1, "ja3_variants": [ "2224f6aab636c4ba6c7fd4f51a20ebd8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_74b2a030724f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "74b2a030724f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788617607, "last_seen": 1788617607, "transport": "t", "ja3_hash": "9b8a5fdb6389ad0b325993c34ddb9667", "ja3_variant_count": 1, "ja3_variants": [ "9b8a5fdb6389ad0b325993c34ddb9667" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_74ba1199eb55", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "74ba1199eb55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-27-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788866869, "last_seen": 1788866869, "transport": "t", "ja3_hash": "c5e1848a969bc0ca18a36cd6167b9e39", "ja3_variant_count": 1, "ja3_variants": [ "c5e1848a969bc0ca18a36cd6167b9e39" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_750c09a938cd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "750c09a938cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-65037-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789217889, "last_seen": 1789217889, "transport": "t", "ja3_hash": "fb8bfdd479809908e30e9a3ad720670a", "ja3_variant_count": 1, "ja3_variants": [ "fb8bfdd479809908e30e9a3ad720670a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_7588f98e390c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "7588f98e390c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-10-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789899461, "last_seen": 1789899461, "transport": "t", "ja3_hash": "ba4d5d48ace3d32d8a6a7f5dcc82da24", "ja3_variant_count": 1, "ja3_variants": [ "ba4d5d48ace3d32d8a6a7f5dcc82da24" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_7bdb926b20d2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "7bdb926b20d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-5-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788772839, "last_seen": 1788772839, "transport": "t", "ja3_hash": "02023e8b728f9f280d10c5eb61b79a8c", "ja3_variant_count": 1, "ja3_variants": [ "02023e8b728f9f280d10c5eb61b79a8c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_80abe2e6cf05", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "80abe2e6cf05", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788953971, "last_seen": 1788953971, "transport": "t", "ja3_hash": "de2175a2c08fafdf14a080df6dfa3082", "ja3_variant_count": 1, "ja3_variants": [ "de2175a2c08fafdf14a080df6dfa3082" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_887ef72b1cda", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "887ef72b1cda", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788829818, "last_seen": 1788829818, "transport": "t", "ja3_hash": "5ecdb6fa8bb1d58b8b8a3a26bcc9ebe8", "ja3_variant_count": 1, "ja3_variants": [ "5ecdb6fa8bb1d58b8b8a3a26bcc9ebe8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_8c8ce6b704e9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "8c8ce6b704e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-11-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788731386, "last_seen": 1788731386, "transport": "t", "ja3_hash": "00b60eb4f153873fdc5392251e350ca1", "ja3_variant_count": 1, "ja3_variants": [ "00b60eb4f153873fdc5392251e350ca1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a725d68ee6a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a725d68ee6a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51764-13-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789470196, "last_seen": 1789470196, "transport": "t", "ja3_hash": "4506b1238289b27d56a83db7fffe2e70", "ja3_variant_count": 1, "ja3_variants": [ "4506b1238289b27d56a83db7fffe2e70" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_ae76c64e55dc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "ae76c64e55dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-4832-27-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788642772, "last_seen": 1788642772, "transport": "t", "ja3_hash": "d6d6feba6cd1e1462666b069671a8f78", "ja3_variant_count": 1, "ja3_variants": [ "d6d6feba6cd1e1462666b069671a8f78" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_ae8603611079", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "ae8603611079", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-45-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788981454, "last_seen": 1788981454, "transport": "t", "ja3_hash": "8af9c6e2449cbbdf993b8c942f96c2aa", "ja3_variant_count": 1, "ja3_variants": [ "8af9c6e2449cbbdf993b8c942f96c2aa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_b51b2d97c520", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "b51b2d97c520", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-5-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789751589, "last_seen": 1789751589, "transport": "t", "ja3_hash": "b9e02fc6f4d63117d61aabaa79fc54d1", "ja3_variant_count": 1, "ja3_variants": [ "b9e02fc6f4d63117d61aabaa79fc54d1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 170 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_b8b7ae883ecb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "b8b7ae883ecb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-51-45-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789637307, "last_seen": 1789637307, "transport": "t", "ja3_hash": "f71cbb7ff3489a8085c98a8bd46af3ce", "ja3_variant_count": 1, "ja3_variants": [ "f71cbb7ff3489a8085c98a8bd46af3ce" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_c62758775ed0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "c62758775ed0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-35-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788975153, "last_seen": 1789656719, "transport": "t", "ja3_hash": "7ee71bf85950954a291615902764fe68", "ja3_variant_count": 2, "ja3_variants": [ "7ee71bf85950954a291615902764fe68", "9f9eb6fab4ad963c3a02b0524c2ae823" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_cf22eaaa2441", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "cf22eaaa2441", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789831237, "last_seen": 1789831237, "transport": "t", "ja3_hash": "54548ad810ac1cc0ec885295cfded9eb", "ja3_variant_count": 1, "ja3_variants": [ "54548ad810ac1cc0ec885295cfded9eb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_d4adaf7c647d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "d4adaf7c647d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-5-51-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027366, "last_seen": 1789027366, "transport": "t", "ja3_hash": "c5ae8db906db285d05fc2e429fc688d8", "ja3_variant_count": 1, "ja3_variants": [ "c5ae8db906db285d05fc2e429fc688d8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_e8a2ff3e190e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "e8a2ff3e190e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-35-27-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788806410, "last_seen": 1788806410, "transport": "t", "ja3_hash": "63fbca09287d066b71b11bb05fec039d", "ja3_variant_count": 1, "ja3_variants": [ "63fbca09287d066b71b11bb05fec039d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_efd731c0cfef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "efd731c0cfef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-17613-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789146374, "last_seen": 1789146374, "transport": "t", "ja3_hash": "ffffb4f3c3c241bc9bdfdd06435f6124", "ja3_variant_count": 1, "ja3_variants": [ "ffffb4f3c3c241bc9bdfdd06435f6124" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_f53d4f0c6d83", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f53d4f0c6d83", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-65037-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788574080, "last_seen": 1788574080, "transport": "t", "ja3_hash": "41ec2ad0de8d1442e54b1e33b52f26c9", "ja3_variant_count": 1, "ja3_variants": [ "41ec2ad0de8d1442e54b1e33b52f26c9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_f5f663cb0124", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f5f663cb0124", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-45-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788989478, "last_seen": 1788989478, "transport": "t", "ja3_hash": "311579d755e39c5982598fd2570bf9c9", "ja3_variant_count": 1, "ja3_variants": [ "311579d755e39c5982598fd2570bf9c9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_f7eeb30d850a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f7eeb30d850a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-27-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789267474, "last_seen": 1789267474, "transport": "t", "ja3_hash": "041e9a98b24d83e050b9d66988771c00", "ja3_variant_count": 1, "ja3_variants": [ "041e9a98b24d83e050b9d66988771c00" ], "user_agents": { "Mozilla/5.0 (Linux; Android 13; SM-A546B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_fa0b95461a4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "fa0b95461a4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-51-45-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789436397, "last_seen": 1789436397, "transport": "t", "ja3_hash": "8eae7d518801095773b50c5441a20fc9", "ja3_variant_count": 1, "ja3_variants": [ "8eae7d518801095773b50c5441a20fc9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_fc367d277595", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "fc367d277595", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-23-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789812227, "last_seen": 1789812227, "transport": "t", "ja3_hash": "c7c109b14ef38fc29a8fe36ff26a91f7", "ja3_variant_count": 1, "ja3_variants": [ "c7c109b14ef38fc29a8fe36ff26a91f7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_fee7f720eaff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "fee7f720eaff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-65037-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789770858, "last_seen": 1789770858, "transport": "t", "ja3_hash": "c83b44d2b35473d41f225fe703782b6c", "ja3_variant_count": 1, "ja3_variants": [ "c83b44d2b35473d41f225fe703782b6c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 12 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_00e5fdb5727a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "00e5fdb5727a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789118485, "last_seen": 1789118485, "transport": "t", "ja3_hash": "018ad0452e9a3ecd4d2dbc8a4b7f7e40", "ja3_variant_count": 1, "ja3_variants": [ "018ad0452e9a3ecd4d2dbc8a4b7f7e40" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_018dfa0d69ba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "018dfa0d69ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-16-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789839357, "last_seen": 1789839357, "transport": "t", "ja3_hash": "1cd70a95eb345c1daa611289c1630293", "ja3_variant_count": 1, "ja3_variants": [ "1cd70a95eb345c1daa611289c1630293" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_1486ec6095e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "1486ec6095e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789732687, "last_seen": 1789732687, "transport": "t", "ja3_hash": "7bbce73c1ab0f5a56863604eb85ec61a", "ja3_variant_count": 1, "ja3_variants": [ "7bbce73c1ab0f5a56863604eb85ec61a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 29 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_15067eac09f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "15067eac09f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-65281-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788874858, "last_seen": 1788874858, "transport": "t", "ja3_hash": "60424e7d730e2ba320597814130b1686", "ja3_variant_count": 1, "ja3_variants": [ "60424e7d730e2ba320597814130b1686" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_2cf7292e4b88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "2cf7292e4b88", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-16-13-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788489311, "last_seen": 1789029457, "transport": "t", "ja3_hash": "0a446f8cbc0a0b860185e49cb5e77ca9", "ja3_variant_count": 2, "ja3_variants": [ "0a446f8cbc0a0b860185e49cb5e77ca9", "f087001ee769d6e3cd396e11a59fe52f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_3ede70aea242", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "3ede70aea242", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-16-45-23,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788902996, "last_seen": 1788902996, "transport": "t", "ja3_hash": "1db8ce339cb792a9f1f455cab9f85d6f", "ja3_variant_count": 1, "ja3_variants": [ "1db8ce339cb792a9f1f455cab9f85d6f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_576eefa15e01", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "576eefa15e01", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-51-13-45,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789698050, "last_seen": 1789698050, "transport": "t", "ja3_hash": "9d60fad3d4b13ba4a6137f650aa3472d", "ja3_variant_count": 1, "ja3_variants": [ "9d60fad3d4b13ba4a6137f650aa3472d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_593de5067a8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "593de5067a8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-16-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788728085, "last_seen": 1788728085, "transport": "t", "ja3_hash": "464289aef370a8e9daf864a80971f29a", "ja3_variant_count": 1, "ja3_variants": [ "464289aef370a8e9daf864a80971f29a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_7a9b9a19fcfc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "7a9b9a19fcfc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788780470, "last_seen": 1788780470, "transport": "t", "ja3_hash": "35376d3d7a80a30d4598ddbecc86c76a", "ja3_variant_count": 1, "ja3_variants": [ "35376d3d7a80a30d4598ddbecc86c76a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_973c2305602d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "973c2305602d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-16-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788659609, "last_seen": 1788659609, "transport": "t", "ja3_hash": "1fadbace1082bf44b4e01700b200acd0", "ja3_variant_count": 1, "ja3_variants": [ "1fadbace1082bf44b4e01700b200acd0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_9d0a82b4e08d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "9d0a82b4e08d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789645504, "last_seen": 1789645504, "transport": "t", "ja3_hash": "2f26fbd693cfd8254756e28b07ac25cc", "ja3_variant_count": 1, "ja3_variants": [ "2f26fbd693cfd8254756e28b07ac25cc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_9e0eea664116", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "9e0eea664116", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-27-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789783699, "last_seen": 1789783699, "transport": "t", "ja3_hash": "92f1a99b1dd344c241b01a4c5ef2fefb", "ja3_variant_count": 1, "ja3_variants": [ "92f1a99b1dd344c241b01a4c5ef2fefb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_a1a8e7adc85b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "a1a8e7adc85b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-65037-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789490180, "last_seen": 1789490180, "transport": "t", "ja3_hash": "26d00d41aa1e8d85a2b2031f483ae021", "ja3_variant_count": 1, "ja3_variants": [ "26d00d41aa1e8d85a2b2031f483ae021" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_aa9c8f4595c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "aa9c8f4595c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789569363, "last_seen": 1789569363, "transport": "t", "ja3_hash": "059d4e98c7e0ed46cf6e05c21fa3a679", "ja3_variant_count": 1, "ja3_variants": [ "059d4e98c7e0ed46cf6e05c21fa3a679" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_b54375549db3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "b54375549db3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-4832-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789636626, "last_seen": 1789636626, "transport": "t", "ja3_hash": "932b95e77f9a7e08c313cd332ac82511", "ja3_variant_count": 1, "ja3_variants": [ "932b95e77f9a7e08c313cd332ac82511" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_b8096f3c2241", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "b8096f3c2241", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-5-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788762403, "last_seen": 1788762403, "transport": "t", "ja3_hash": "7d63d16968b32839a92992a50c24a765", "ja3_variant_count": 1, "ja3_variants": [ "7d63d16968b32839a92992a50c24a765" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_c2e3a95f8649", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "c2e3a95f8649", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-35-27-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788797545, "last_seen": 1788797545, "transport": "t", "ja3_hash": "c8a372b0b994eb4d645a2b0c5b0436d4", "ja3_variant_count": 1, "ja3_variants": [ "c8a372b0b994eb4d645a2b0c5b0436d4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_d895c19cee2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "d895c19cee2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-11-51-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788973308, "last_seen": 1788973308, "transport": "t", "ja3_hash": "769e108ffb08e6d679f1c9c5a2e47446", "ja3_variant_count": 1, "ja3_variants": [ "769e108ffb08e6d679f1c9c5a2e47446" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_eab4904aa888", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "eab4904aa888", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-13-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789950020, "last_seen": 1789950020, "transport": "t", "ja3_hash": "b77bfee0263042359bbc0f2ab3434d14", "ja3_variant_count": 1, "ja3_variants": [ "b77bfee0263042359bbc0f2ab3434d14" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_f4757612fa37", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "f4757612fa37", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-51-65281-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788572489, "last_seen": 1788572489, "transport": "t", "ja3_hash": "840aa65d686163899e60c2161fac1715", "ja3_variant_count": 1, "ja3_variants": [ "840aa65d686163899e60c2161fac1715" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1505ht_8daaf6152771_250fdb31c037", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505ht", "b": "8daaf6152771", "c": "250fdb31c037", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788838969, "last_seen": 1788838969, "transport": "t", "ja3_hash": "4cf6b6ab0fbf55e6e97b4fc9f898615b", "ja3_variant_count": 1, "ja3_variants": [ "4cf6b6ab0fbf55e6e97b4fc9f898615b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505ht_8daaf6152771_f4757612fa37", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505ht", "b": "8daaf6152771", "c": "f4757612fa37", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788883155, "last_seen": 1788883155, "transport": "t", "ja3_hash": "71aa64d3388a37629e79b7a96a8fc14a", "ja3_variant_count": 1, "ja3_variants": [ "71aa64d3388a37629e79b7a96a8fc14a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_094197fcbfad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "094197fcbfad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-35-11-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789150686, "last_seen": 1789150686, "transport": "t", "ja3_hash": "46f950b3e22a46838f5c619e79951c71", "ja3_variant_count": 1, "ja3_variants": [ "46f950b3e22a46838f5c619e79951c71" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 38 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_0d1d30308122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "0d1d30308122", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-65281-23-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789656773, "last_seen": 1789656773, "transport": "t", "ja3_hash": "cda32ff5aeca18c0fd1f5ed1f35cef66", "ja3_variant_count": 1, "ja3_variants": [ "cda32ff5aeca18c0fd1f5ed1f35cef66" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Vivaldi/7.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_1837135c42ed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "1837135c42ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-11-35-51-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789658532, "last_seen": 1789658532, "transport": "t", "ja3_hash": "b65b5ad9a34aafd7313be309ef0c72e9", "ja3_variant_count": 1, "ja3_variants": [ "b65b5ad9a34aafd7313be309ef0c72e9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_1d4268fe7de8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "1d4268fe7de8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-10-45-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788792126, "last_seen": 1788792126, "transport": "t", "ja3_hash": "57aa0c7b9166681739b8cf354aafed1e", "ja3_variant_count": 1, "ja3_variants": [ "57aa0c7b9166681739b8cf354aafed1e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_293be4868a3b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "293be4868a3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-10-65037-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789294834, "last_seen": 1789294834, "transport": "t", "ja3_hash": "460b9883568cd0871063e106a19878e7", "ja3_variant_count": 1, "ja3_variants": [ "460b9883568cd0871063e106a19878e7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 19 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_39655852cc9d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "39655852cc9d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-35-65281-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789014952, "last_seen": 1789014952, "transport": "t", "ja3_hash": "bf2c4cc8170df97c3b17849ac71950f6", "ja3_variant_count": 1, "ja3_variants": [ "bf2c4cc8170df97c3b17849ac71950f6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_3c0553fe1d7b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "3c0553fe1d7b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51-5-11-65281-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789912451, "last_seen": 1789912451, "transport": "t", "ja3_hash": "d693e2d2fb026a51efa092b7d23da74a", "ja3_variant_count": 1, "ja3_variants": [ "d693e2d2fb026a51efa092b7d23da74a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_4334c424629a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "4334c424629a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-45-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789396330, "last_seen": 1789396330, "transport": "t", "ja3_hash": "4f8539eb293095783a2ae2b10e87c92b", "ja3_variant_count": 1, "ja3_variants": [ "4f8539eb293095783a2ae2b10e87c92b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_45954740716e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "45954740716e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-18-45-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788885165, "last_seen": 1788885165, "transport": "t", "ja3_hash": "e9bb4c3de8aae64328f39eaff1f91c30", "ja3_variant_count": 1, "ja3_variants": [ "e9bb4c3de8aae64328f39eaff1f91c30" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_4abb65c9bf47", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "4abb65c9bf47", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-65037-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788834517, "last_seen": 1788834517, "transport": "t", "ja3_hash": "ce5f63bcc037f034cc4bae73f7d9964c", "ja3_variant_count": 1, "ja3_variants": [ "ce5f63bcc037f034cc4bae73f7d9964c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_56ad2cfda573", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "56ad2cfda573", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-5-23-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788808564, "last_seen": 1788808564, "transport": "t", "ja3_hash": "6f6c1aa7c2d39c3fad8cdd60997eb67c", "ja3_variant_count": 1, "ja3_variants": [ "6f6c1aa7c2d39c3fad8cdd60997eb67c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_675fbd75641a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "675fbd75641a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-35-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788837765, "last_seen": 1788942577, "transport": "t", "ja3_hash": "08e00a1f2982c0cd885a9fbb17a07360", "ja3_variant_count": 2, "ja3_variants": [ "08e00a1f2982c0cd885a9fbb17a07360", "13a8718529641ac0b769e76ada53536f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 8, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_6e28f47db6e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "6e28f47db6e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-27-35-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788762174, "last_seen": 1788762174, "transport": "t", "ja3_hash": "60c606bdba03701d90f0a0cc1fc90e89", "ja3_variant_count": 1, "ja3_variants": [ "60c606bdba03701d90f0a0cc1fc90e89" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_7a5b9a87fdd6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "7a5b9a87fdd6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-13-51-18-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789351846, "last_seen": 1789351846, "transport": "t", "ja3_hash": "d5caa4272578dbc49a5a206e1dab3ebf", "ja3_variant_count": 1, "ja3_variants": [ "d5caa4272578dbc49a5a206e1dab3ebf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_7e4550f4627f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "7e4550f4627f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-17613-18-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788639824, "last_seen": 1788639824, "transport": "t", "ja3_hash": "406fdd8bb137893eea991b1279bd37e7", "ja3_variant_count": 1, "ja3_variants": [ "406fdd8bb137893eea991b1279bd37e7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_864251b56dc3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "864251b56dc3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-5-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789931638, "last_seen": 1789931638, "transport": "t", "ja3_hash": "7973f7f5936427c09f460d3ede41effe", "ja3_variant_count": 1, "ja3_variants": [ "7973f7f5936427c09f460d3ede41effe" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 6 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_86b38226b296", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "86b38226b296", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-45-18-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788646796, "last_seen": 1788646796, "transport": "t", "ja3_hash": "ddea8f9f3488d07bf13772ab6400476b", "ja3_variant_count": 1, "ja3_variants": [ "ddea8f9f3488d07bf13772ab6400476b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_887fb496a537", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "887fb496a537", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-27-45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788793367, "last_seen": 1788793367, "transport": "t", "ja3_hash": "2a0b845caf441253ea56fc6706f4f945", "ja3_variant_count": 1, "ja3_variants": [ "2a0b845caf441253ea56fc6706f4f945" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_90778be49b34", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "90778be49b34", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-18-65037-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789559505, "last_seen": 1789559505, "transport": "t", "ja3_hash": "2472f16a51e5c8eefc5549cd6f6c444e", "ja3_variant_count": 1, "ja3_variants": [ "2472f16a51e5c8eefc5549cd6f6c444e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_98c14a1156fd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "98c14a1156fd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-18-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788763560, "last_seen": 1788763560, "transport": "t", "ja3_hash": "1854b013a90cd517c36ba23f6144a2ef", "ja3_variant_count": 1, "ja3_variants": [ "1854b013a90cd517c36ba23f6144a2ef" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_9e31763dec8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "9e31763dec8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-65281-13-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788996108, "last_seen": 1788996108, "transport": "t", "ja3_hash": "3df825244ad13c1c818a4104196eebdc", "ja3_variant_count": 1, "ja3_variants": [ "3df825244ad13c1c818a4104196eebdc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_a32a8511cf52", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "a32a8511cf52", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-51-35-13-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789654452, "last_seen": 1789654452, "transport": "t", "ja3_hash": "35ede6be2c8aa384d072bc17b99a4d98", "ja3_variant_count": 1, "ja3_variants": [ "35ede6be2c8aa384d072bc17b99a4d98" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_a33076a6e985", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "a33076a6e985", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-65281-17613-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789023388, "last_seen": 1789023388, "transport": "t", "ja3_hash": "6b1807b8ca919722d9cf83437c6e79d2", "ja3_variant_count": 1, "ja3_variants": [ "6b1807b8ca919722d9cf83437c6e79d2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_ad086e4afecd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "ad086e4afecd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-17613-51-18-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789710735, "last_seen": 1789710735, "transport": "t", "ja3_hash": "5ea94096664495f688806fe402ca2c0f", "ja3_variant_count": 1, "ja3_variants": [ "5ea94096664495f688806fe402ca2c0f" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.2208.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_ae03bb9a7348", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "ae03bb9a7348", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-65281-10-51-65037,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789882091, "last_seen": 1789882091, "transport": "t", "ja3_hash": "c3601a1dbb3da1b47e9089a523d264b4", "ja3_variant_count": 1, "ja3_variants": [ "c3601a1dbb3da1b47e9089a523d264b4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_b58807c43663", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "b58807c43663", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-17613-27-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788811400, "last_seen": 1788811400, "transport": "t", "ja3_hash": "060bbd6e1d92bc12be702075773203ba", "ja3_variant_count": 1, "ja3_variants": [ "060bbd6e1d92bc12be702075773203ba" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_bb29892b6387", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "bb29892b6387", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-23-65281-11-5-17613,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789746841, "last_seen": 1789746841, "transport": "t", "ja3_hash": "4833e205566d65d4cd47d10fb77a938d", "ja3_variant_count": 1, "ja3_variants": [ "4833e205566d65d4cd47d10fb77a938d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_c2efd3ad11ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "c2efd3ad11ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-51-11-5-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789593943, "last_seen": 1789593943, "transport": "t", "ja3_hash": "2a3996870a894cd1fdfc7d139577e9ae", "ja3_variant_count": 1, "ja3_variants": [ "2a3996870a894cd1fdfc7d139577e9ae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_cf2ea50fd026", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "cf2ea50fd026", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-13-23-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788607234, "last_seen": 1788607234, "transport": "t", "ja3_hash": "8cbd91226e422fa2d686caf345d20770", "ja3_variant_count": 1, "ja3_variants": [ "8cbd91226e422fa2d686caf345d20770" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_de1f247ae4a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "de1f247ae4a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-10-18-5-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788849132, "last_seen": 1788849132, "transport": "t", "ja3_hash": "a8e6845affb60e65c55d491dc579ed3f", "ja3_variant_count": 1, "ja3_variants": [ "a8e6845affb60e65c55d491dc579ed3f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_e4140d2a0147", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "e4140d2a0147", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-23-18-51-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788862385, "last_seen": 1788862385, "transport": "t", "ja3_hash": "cbfa426adf3ab9fc23e5d7c5697d1dd7", "ja3_variant_count": 1, "ja3_variants": [ "cbfa426adf3ab9fc23e5d7c5697d1dd7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_e8a64de69299", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "e8a64de69299", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-23-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788846481, "last_seen": 1788846481, "transport": "t", "ja3_hash": "213cd7e7c5ad3a7fdf2b18dd50ab891e", "ja3_variant_count": 1, "ja3_variants": [ "213cd7e7c5ad3a7fdf2b18dd50ab891e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_e955a95ad90d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "e955a95ad90d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-51-10-23-17613,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788806953, "last_seen": 1788806953, "transport": "t", "ja3_hash": "4df3e9c0601a90b127d758e173043f2a", "ja3_variant_count": 1, "ja3_variants": [ "4df3e9c0601a90b127d758e173043f2a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_f290a7462693", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "f290a7462693", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-5-35-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788766621, "last_seen": 1788766621, "transport": "t", "ja3_hash": "a2eba33a47f690276038c8eb2a94d06b", "ja3_variant_count": 1, "ja3_variants": [ "a2eba33a47f690276038c8eb2a94d06b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_f34caeb9730e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "f34caeb9730e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-27-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788964899, "last_seen": 1788964899, "transport": "t", "ja3_hash": "f9184c1f6d86c8985e1bc97e2fce0311", "ja3_variant_count": 1, "ja3_variants": [ "f9184c1f6d86c8985e1bc97e2fce0311" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_00186e61df35", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "00186e61df35", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-65281-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789054600, "last_seen": 1789054600, "transport": "t", "ja3_hash": "4c6a895182ec387b4bfbff17113d32b4", "ja3_variant_count": 1, "ja3_variants": [ "4c6a895182ec387b4bfbff17113d32b4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_081dc4e13c55", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "081dc4e13c55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-16-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788784248, "last_seen": 1788784248, "transport": "t", "ja3_hash": "9ad7aa195988004ae04004959bbf8041", "ja3_variant_count": 1, "ja3_variants": [ "9ad7aa195988004ae04004959bbf8041" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_0b70091c6e34", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "0b70091c6e34", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-35-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788724248, "last_seen": 1788724248, "transport": "t", "ja3_hash": "961e91f694f535ada89c132a2ffa52f9", "ja3_variant_count": 1, "ja3_variants": [ "961e91f694f535ada89c132a2ffa52f9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_0c4c096556ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "0c4c096556ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-51-16-17613-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788572616, "last_seen": 1788572616, "transport": "t", "ja3_hash": "94812c84ab7896e48c23344fd513dd16", "ja3_variant_count": 1, "ja3_variants": [ "94812c84ab7896e48c23344fd513dd16" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_1f31923350e8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "1f31923350e8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-35-13-51-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788909456, "last_seen": 1788909456, "transport": "t", "ja3_hash": "3f446e299ffc75842dfed2158fc6f962", "ja3_variant_count": 1, "ja3_variants": [ "3f446e299ffc75842dfed2158fc6f962" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.0 Safari/537.36 Edg/132.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_331bb8534158", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "331bb8534158", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-11-27-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789796844, "last_seen": 1789796844, "transport": "t", "ja3_hash": "73df1b0cd61b77c6f5a984efae252df1", "ja3_variant_count": 1, "ja3_variants": [ "73df1b0cd61b77c6f5a984efae252df1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_53ac864b937b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "53ac864b937b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-51-10-65281-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788724241, "last_seen": 1789680364, "transport": "t", "ja3_hash": "bbccae4889e2d874efee6d54bf419722", "ja3_variant_count": 2, "ja3_variants": [ "bbccae4889e2d874efee6d54bf419722", "2cc5dd92f78fe00db877036fdad980e3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_8ddcb5e74667", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "8ddcb5e74667", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-65037-18-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789796842, "last_seen": 1789796842, "transport": "t", "ja3_hash": "661e5fd30fffcaaab6c2a732430382b2", "ja3_variant_count": 1, "ja3_variants": [ "661e5fd30fffcaaab6c2a732430382b2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_a414954f5d24", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "a414954f5d24", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-65037-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788799273, "last_seen": 1788799273, "transport": "t", "ja3_hash": "013b632bb9d68da1e465ae337d618fe9", "ja3_variant_count": 1, "ja3_variants": [ "013b632bb9d68da1e465ae337d618fe9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_a986fbca8175", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "a986fbca8175", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-10-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788608969, "last_seen": 1788608969, "transport": "t", "ja3_hash": "7cbc5ac688f361f37b94856cca769166", "ja3_variant_count": 1, "ja3_variants": [ "7cbc5ac688f361f37b94856cca769166" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_b2f2832a02be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "b2f2832a02be", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-10-65037-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789811983, "last_seen": 1789811983, "transport": "t", "ja3_hash": "8dcccbfe7b80d7dc033c72df03b77c68", "ja3_variant_count": 1, "ja3_variants": [ "8dcccbfe7b80d7dc033c72df03b77c68" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_b68bf6ea551c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "b68bf6ea551c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-35-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789691694, "last_seen": 1789691694, "transport": "t", "ja3_hash": "a478f9336e3c23aff0e95aa96c73fd4c", "ja3_variant_count": 1, "ja3_variants": [ "a478f9336e3c23aff0e95aa96c73fd4c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_c8afddb0bd35", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "c8afddb0bd35", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-16-17613-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789116836, "last_seen": 1789116836, "transport": "t", "ja3_hash": "be86b8426dc69dd5e437e5131a2408cc", "ja3_variant_count": 1, "ja3_variants": [ "be86b8426dc69dd5e437e5131a2408cc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_cfb0a2c91ae8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "cfb0a2c91ae8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-65037-11-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789203227, "last_seen": 1789203227, "transport": "t", "ja3_hash": "90c246dc45d367ac1bff86a5280d5fc3", "ja3_variant_count": 1, "ja3_variants": [ "90c246dc45d367ac1bff86a5280d5fc3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_d792aaa440c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "d792aaa440c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-5-23-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788726939, "last_seen": 1788726939, "transport": "t", "ja3_hash": "f396e8d566ad92aa111a67f91b707ecb", "ja3_variant_count": 1, "ja3_variants": [ "f396e8d566ad92aa111a67f91b707ecb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 7 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_dea0aacd5083", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "dea0aacd5083", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-51764-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789649709, "last_seen": 1789649709, "transport": "t", "ja3_hash": "dfce6ebdfcde4a1db6586398ee075dc2", "ja3_variant_count": 1, "ja3_variants": [ "dfce6ebdfcde4a1db6586398ee075dc2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 90 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_e0b7aceef8cc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "e0b7aceef8cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-10-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788784914, "last_seen": 1788784914, "transport": "t", "ja3_hash": "4731cfc7756ec9ed20cf743b1ac78cee", "ja3_variant_count": 1, "ja3_variants": [ "4731cfc7756ec9ed20cf743b1ac78cee" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_fadabebf0399", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "fadabebf0399", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,16-10-17613-51-18-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789842143, "last_seen": 1789842143, "transport": "t", "ja3_hash": "e47b9073c44e661a8f61a52033318e3e", "ja3_variant_count": 1, "ja3_variants": [ "e47b9073c44e661a8f61a52033318e3e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_fc5370c5fdbe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "fc5370c5fdbe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-16-13-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789775626, "last_seen": 1789775626, "transport": "t", "ja3_hash": "036fa3de3dcbdc7725bb8eb1d16a79f2", "ja3_variant_count": 1, "ja3_variants": [ "036fa3de3dcbdc7725bb8eb1d16a79f2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t12i1506ht_8daaf6152771_509c15e5704f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506ht", "b": "8daaf6152771", "c": "509c15e5704f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-10-27-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788825127, "last_seen": 1788825127, "transport": "t", "ja3_hash": "e94fe253ddc24106f2803323745d7c4c", "ja3_variant_count": 1, "ja3_variants": [ "e94fe253ddc24106f2803323745d7c4c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506ht_8daaf6152771_7b40faca1868", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506ht", "b": "8daaf6152771", "c": "7b40faca1868", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-13-5-16-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789625639, "last_seen": 1789625639, "transport": "t", "ja3_hash": "c2acd56c21e70e7b53af7b1f6c1436f1", "ja3_variant_count": 1, "ja3_variants": [ "c2acd56c21e70e7b53af7b1f6c1436f1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506ht_8daaf6152771_99cf02611a98", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506ht", "b": "8daaf6152771", "c": "99cf02611a98", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-16-51-18-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788951417, "last_seen": 1788951417, "transport": "t", "ja3_hash": "8d16bcc8e077670cb92e41d776b8b048", "ja3_variant_count": 1, "ja3_variants": [ "8d16bcc8e077670cb92e41d776b8b048" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506ht_8daaf6152771_b2d61f6626db", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506ht", "b": "8daaf6152771", "c": "b2d61f6626db", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-16-35-27-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789883877, "last_seen": 1789883877, "transport": "t", "ja3_hash": "d6d914f1b5ae7c4ade58bdbe908b23ef", "ja3_variant_count": 1, "ja3_variants": [ "d6d914f1b5ae7c4ade58bdbe908b23ef" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506ht_8daaf6152771_d0bfba7a2db4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506ht", "b": "8daaf6152771", "c": "d0bfba7a2db4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-65281-16-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788830579, "last_seen": 1788830579, "transport": "t", "ja3_hash": "06ae771fcdd8234d5a2fd864fcecf605", "ja3_variant_count": 1, "ja3_variants": [ "06ae771fcdd8234d5a2fd864fcecf605" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506ht_8daaf6152771_e3ae25551c41", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506ht", "b": "8daaf6152771", "c": "e3ae25551c41", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-35-51-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789632015, "last_seen": 1789632015, "transport": "t", "ja3_hash": "1609ac5e6c255348335dc33431059ed1", "ja3_variant_count": 1, "ja3_variants": [ "1609ac5e6c255348335dc33431059ed1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_036a8ff22aba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "036a8ff22aba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-51-11-27-10-13-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789819764, "last_seen": 1789819764, "transport": "t", "ja3_hash": "464240afb05bcfb7d3361fd831708862", "ja3_variant_count": 1, "ja3_variants": [ "464240afb05bcfb7d3361fd831708862" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_0edb7fcc6290", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "0edb7fcc6290", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-18-35-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788785596, "last_seen": 1788785596, "transport": "t", "ja3_hash": "0046f6f29b16c4c469cf82b7a3185915", "ja3_variant_count": 1, "ja3_variants": [ "0046f6f29b16c4c469cf82b7a3185915" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_28b321bedafd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "28b321bedafd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-45-23-65037-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788765366, "last_seen": 1788765366, "transport": "t", "ja3_hash": "712399a125ebfb8d204079f53152f6a5", "ja3_variant_count": 1, "ja3_variants": [ "712399a125ebfb8d204079f53152f6a5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_4c441e9e9f28", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "4c441e9e9f28", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-17613-35-51-10-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788853079, "last_seen": 1788853079, "transport": "t", "ja3_hash": "290ea28b635cb7b5362e11160742675d", "ja3_variant_count": 1, "ja3_variants": [ "290ea28b635cb7b5362e11160742675d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_552a9019b956", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "552a9019b956", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-65037-11-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789687186, "last_seen": 1789687186, "transport": "t", "ja3_hash": "e39f9fa2ecc126c38a85aad31fe6a81d", "ja3_variant_count": 1, "ja3_variants": [ "e39f9fa2ecc126c38a85aad31fe6a81d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_5a1c82a80bf1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "5a1c82a80bf1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,18-65037-23-10-35-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788533342, "last_seen": 1789656803, "transport": "t", "ja3_hash": "5e0ac285ca0bd67a06674daeedb9bff7", "ja3_variant_count": 2, "ja3_variants": [ "5e0ac285ca0bd67a06674daeedb9bff7", "1323f0180711ad90dc65222683985180" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_5ca4dcc0e74a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "5ca4dcc0e74a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-18-65281-51-5-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788878033, "last_seen": 1788878033, "transport": "t", "ja3_hash": "21a898b40a1823cac82531b3f3d4db08", "ja3_variant_count": 1, "ja3_variants": [ "21a898b40a1823cac82531b3f3d4db08" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_6084bb0a2d37", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "6084bb0a2d37", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-10-65037-17613-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788711530, "last_seen": 1788711530, "transport": "t", "ja3_hash": "9f087a7066dbcce951827e81c971df3c", "ja3_variant_count": 1, "ja3_variants": [ "9f087a7066dbcce951827e81c971df3c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_6e9dadad1f9a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "6e9dadad1f9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-51-5-45-11-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789166734, "last_seen": 1789166734, "transport": "t", "ja3_hash": "001f06f5c751dabe8a83d8b13737e694", "ja3_variant_count": 1, "ja3_variants": [ "001f06f5c751dabe8a83d8b13737e694" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_6fe346eb8790", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "6fe346eb8790", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-13-10-65037-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788768146, "last_seen": 1788768146, "transport": "t", "ja3_hash": "fbd290b31f6e3e25e7ce9d2f1d41b643", "ja3_variant_count": 1, "ja3_variants": [ "fbd290b31f6e3e25e7ce9d2f1d41b643" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_75c651642535", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "75c651642535", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-51-45-35-13-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789415510, "last_seen": 1789415510, "transport": "t", "ja3_hash": "5ae82f0862ae7962a6f960534c7dfb97", "ja3_variant_count": 1, "ja3_variants": [ "5ae82f0862ae7962a6f960534c7dfb97" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 15 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_778952d459fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "778952d459fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-65281-11-17613-27-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788724244, "last_seen": 1788724244, "transport": "t", "ja3_hash": "0ff96951b65a92d3a5b600ddf8123510", "ja3_variant_count": 1, "ja3_variants": [ "0ff96951b65a92d3a5b600ddf8123510" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_7ef62ae2b2e3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "7ef62ae2b2e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-65281-45-5-23-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788849169, "last_seen": 1788849169, "transport": "t", "ja3_hash": "d3f384fd6cc3dad3ecdc504f12960350", "ja3_variant_count": 1, "ja3_variants": [ "d3f384fd6cc3dad3ecdc504f12960350" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_81664736d960", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "81664736d960", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-51-11-23-27-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788880663, "last_seen": 1788880663, "transport": "t", "ja3_hash": "6f8a0d47fc44aaeb1378f8b55e228dde", "ja3_variant_count": 1, "ja3_variants": [ "6f8a0d47fc44aaeb1378f8b55e228dde" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_8566ab5c5e59", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "8566ab5c5e59", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-13-51-5-35-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788532055, "last_seen": 1788532055, "transport": "t", "ja3_hash": "339bb87479a316d62f80174c84e7a599", "ja3_variant_count": 1, "ja3_variants": [ "339bb87479a316d62f80174c84e7a599" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_9ad5928603b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "9ad5928603b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-13-23-17613-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789931639, "last_seen": 1789931639, "transport": "t", "ja3_hash": "c494d738d9bcc1ea073daf5dd720169e", "ja3_variant_count": 1, "ja3_variants": [ "c494d738d9bcc1ea073daf5dd720169e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 12 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_a23b94368855", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "a23b94368855", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-10-45-51-17613-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789090470, "last_seen": 1789090470, "transport": "t", "ja3_hash": "32a891f17072db3446a7b461bd23b5e4", "ja3_variant_count": 1, "ja3_variants": [ "32a891f17072db3446a7b461bd23b5e4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 235 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_ab7ade6a2521", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "ab7ade6a2521", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-27-65281-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788961398, "last_seen": 1788961398, "transport": "t", "ja3_hash": "c4ea38787b4d101c337edc2bd97096fe", "ja3_variant_count": 1, "ja3_variants": [ "c4ea38787b4d101c337edc2bd97096fe" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_afd31b3d9c4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "afd31b3d9c4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-17613-10-13-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788776668, "last_seen": 1788776668, "transport": "t", "ja3_hash": "2e28b2d4fcd51e506425388df64ac016", "ja3_variant_count": 1, "ja3_variants": [ "2e28b2d4fcd51e506425388df64ac016" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_bc4cf4be557c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "bc4cf4be557c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-51-17613-18-65281-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789535774, "last_seen": 1789535774, "transport": "t", "ja3_hash": "25c1e93193d00142fe96a3ff66eeb361", "ja3_variant_count": 1, "ja3_variants": [ "25c1e93193d00142fe96a3ff66eeb361" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_c3ea69647895", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "c3ea69647895", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-18-11-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789023391, "last_seen": 1789023391, "transport": "t", "ja3_hash": "205f1d03a1ea4ec79bfb9bd08712a7d2", "ja3_variant_count": 1, "ja3_variants": [ "205f1d03a1ea4ec79bfb9bd08712a7d2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_c9352f88db8b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "c9352f88db8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-27-65281-17613-45-51764,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789750000, "last_seen": 1789750000, "transport": "t", "ja3_hash": "7e8b771436acab9e3c7ab79fc30fa68d", "ja3_variant_count": 1, "ja3_variants": [ "7e8b771436acab9e3c7ab79fc30fa68d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_cbd2c6f4220a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "cbd2c6f4220a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-5-11-13-51-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789628312, "last_seen": 1789628312, "transport": "t", "ja3_hash": "d72d6f9bceef6843018c60b6c9356d2b", "ja3_variant_count": 1, "ja3_variants": [ "d72d6f9bceef6843018c60b6c9356d2b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_cd2a87adc4a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "cd2a87adc4a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-45-65281-17613-51-23,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789693573, "last_seen": 1789693573, "transport": "t", "ja3_hash": "78183f409775aea4d9b49847fd6529e9", "ja3_variant_count": 1, "ja3_variants": [ "78183f409775aea4d9b49847fd6529e9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_cf1f46ec8df9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "cf1f46ec8df9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-35-65281-45-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789692930, "last_seen": 1789692930, "transport": "t", "ja3_hash": "b55094b481744ddff4ffebd44ff629c6", "ja3_variant_count": 1, "ja3_variants": [ "b55094b481744ddff4ffebd44ff629c6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_d6321ebdb574", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "d6321ebdb574", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-23-17613-10-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788520168, "last_seen": 1788520168, "transport": "t", "ja3_hash": "807e3cad1383b12fb3a7c0ca5e8615d7", "ja3_variant_count": 1, "ja3_variants": [ "807e3cad1383b12fb3a7c0ca5e8615d7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_da8aa6b8db85", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "da8aa6b8db85", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-51-5-45-10-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730659, "last_seen": 1789730659, "transport": "t", "ja3_hash": "a0eebc88502d555001ba7d95125a8a1e", "ja3_variant_count": 1, "ja3_variants": [ "a0eebc88502d555001ba7d95125a8a1e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_eecc02183d51", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "eecc02183d51", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-35-18-27-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788821245, "last_seen": 1788821245, "transport": "t", "ja3_hash": "8b2544cad8b9c8cb5b1494f912fd177f", "ja3_variant_count": 1, "ja3_variants": [ "8b2544cad8b9c8cb5b1494f912fd177f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_f48d137797ac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "f48d137797ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-51-27-10-5-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788835106, "last_seen": 1788835106, "transport": "t", "ja3_hash": "8ac54fb11425bc872f3ffa0f5e9ca8cc", "ja3_variant_count": 1, "ja3_variants": [ "8ac54fb11425bc872f3ffa0f5e9ca8cc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_f619fb1d1be5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "f619fb1d1be5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-65037-35-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788550303, "last_seen": 1788550303, "transport": "t", "ja3_hash": "f3cf8dd93f3eba48159ebc69ee40e700", "ja3_variant_count": 1, "ja3_variants": [ "f3cf8dd93f3eba48159ebc69ee40e700" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_fb128520d885", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "fb128520d885", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-11-45-5-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789061772, "last_seen": 1789061772, "transport": "t", "ja3_hash": "09058169df2be2d02fdc07dd77458020", "ja3_variant_count": 1, "ja3_variants": [ "09058169df2be2d02fdc07dd77458020" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_feb0230de1da", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "feb0230de1da", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-5-18-27-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789447992, "last_seen": 1789447992, "transport": "t", "ja3_hash": "54421b4ff3eeefa2e628e172acb3ef32", "ja3_variant_count": 1, "ja3_variants": [ "54421b4ff3eeefa2e628e172acb3ef32" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_ffdcb2a7ab20", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "ffdcb2a7ab20", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-17613-51-18-11-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787814809, "last_seen": 1789258521, "transport": "t", "ja3_hash": "a6abf09e64582b7f05d4c4249d314814", "ja3_variant_count": 1, "ja3_variants": [ "a6abf09e64582b7f05d4c4249d314814" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3362.39 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.2899.75 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.2353.150 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_02ad8bbf020e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "02ad8bbf020e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-17613-5-51-35-23,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789266419, "last_seen": 1789266419, "transport": "t", "ja3_hash": "7c10676a5d2f2b790281ab178ee8bc82", "ja3_variant_count": 1, "ja3_variants": [ "7c10676a5d2f2b790281ab178ee8bc82" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 41 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_0d151c494193", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "0d151c494193", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-5-35-16-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788762917, "last_seen": 1788762917, "transport": "t", "ja3_hash": "1b54d9291b67da7aba4fca1df8eb0e9c", "ja3_variant_count": 1, "ja3_variants": [ "1b54d9291b67da7aba4fca1df8eb0e9c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_281fed1d364b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "281fed1d364b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-51764-65281-13-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669088, "last_seen": 1789669088, "transport": "t", "ja3_hash": "3dfbdb5660527ad0704545fdb63e7a23", "ja3_variant_count": 1, "ja3_variants": [ "3dfbdb5660527ad0704545fdb63e7a23" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_3a9b64715041", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "3a9b64715041", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-51-45-35-16-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788810496, "last_seen": 1788810496, "transport": "t", "ja3_hash": "ea87bfadd5bc5d26a5304e6f1d497bfa", "ja3_variant_count": 1, "ja3_variants": [ "ea87bfadd5bc5d26a5304e6f1d497bfa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_8b84e4d8fc40", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "8b84e4d8fc40", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-11-51764-16-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789129004, "last_seen": 1789129004, "transport": "t", "ja3_hash": "894ebab05ade3b216a0eb2d860c51108", "ja3_variant_count": 1, "ja3_variants": [ "894ebab05ade3b216a0eb2d860c51108" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_8c57c51eadb1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "8c57c51eadb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-35-51-27-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788721840, "last_seen": 1788721840, "transport": "t", "ja3_hash": "12b114d43e48547088b7d533bc56efbc", "ja3_variant_count": 1, "ja3_variants": [ "12b114d43e48547088b7d533bc56efbc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_a31c4125a9ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "a31c4125a9ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-10-17613-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789926616, "last_seen": 1789926616, "transport": "t", "ja3_hash": "c06e13952dd800d725581b411ebf4017", "ja3_variant_count": 1, "ja3_variants": [ "c06e13952dd800d725581b411ebf4017" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_bc76bc06761a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "bc76bc06761a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-65281-13-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789669084, "last_seen": 1789669084, "transport": "t", "ja3_hash": "f2d62a745fc7677255c3647128f632b0", "ja3_variant_count": 1, "ja3_variants": [ "f2d62a745fc7677255c3647128f632b0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_d01311bf427c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "d01311bf427c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-5-51-16-17613-23,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788796060, "last_seen": 1788796060, "transport": "t", "ja3_hash": "d041b3348e8f11c5c3d5e384d97d8bb3", "ja3_variant_count": 1, "ja3_variants": [ "d041b3348e8f11c5c3d5e384d97d8bb3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_e0ae1bf39523", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "e0ae1bf39523", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-13-27-11-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788780081, "last_seen": 1788780081, "transport": "t", "ja3_hash": "6219a66a3a5088766b4d0d2196a374fc", "ja3_variant_count": 1, "ja3_variants": [ "6219a66a3a5088766b4d0d2196a374fc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_e6ad7ac6402a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "e6ad7ac6402a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-45-16-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788795783, "last_seen": 1788795783, "transport": "t", "ja3_hash": "2fc0ef9c9f371cb64326dbe7e72375c6", "ja3_variant_count": 1, "ja3_variants": [ "2fc0ef9c9f371cb64326dbe7e72375c6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_e71eefb30136", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "e71eefb30136", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-27-16-13-51-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789396345, "last_seen": 1789396345, "transport": "t", "ja3_hash": "92a8f4c989e5383b0ed20aabdae754a9", "ja3_variant_count": 1, "ja3_variants": [ "92a8f4c989e5383b0ed20aabdae754a9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_ebdbc74c6144", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "ebdbc74c6144", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-65281-65037-27-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789869199, "last_seen": 1789869199, "transport": "t", "ja3_hash": "a72790b31ebc22a06c8f0c9156d5c7a1", "ja3_variant_count": 1, "ja3_variants": [ "a72790b31ebc22a06c8f0c9156d5c7a1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 12 }, "ua_disagreement": false } }, { "hash": "t12i1507ht_8daaf6152771_35e4259e568a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507ht", "b": "8daaf6152771", "c": "35e4259e568a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-16-10-13-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788877101, "last_seen": 1788877101, "transport": "t", "ja3_hash": "9e261506d8033af525b3c5f5ac49f516", "ja3_variant_count": 1, "ja3_variants": [ "9e261506d8033af525b3c5f5ac49f516" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507ht_8daaf6152771_46e69a66b437", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507ht", "b": "8daaf6152771", "c": "46e69a66b437", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-65037-27-45-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788827276, "last_seen": 1788827276, "transport": "t", "ja3_hash": "72a3eb02190d2dd66bca06325e99add3", "ja3_variant_count": 1, "ja3_variants": [ "72a3eb02190d2dd66bca06325e99add3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507ht_8daaf6152771_6b0b53dc66e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507ht", "b": "8daaf6152771", "c": "6b0b53dc66e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-18-5-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839809, "last_seen": 1788839809, "transport": "t", "ja3_hash": "78d08219dcff1a340bfec6c003460907", "ja3_variant_count": 1, "ja3_variants": [ "78d08219dcff1a340bfec6c003460907" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507ht_8daaf6152771_b0d754ec0eba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507ht", "b": "8daaf6152771", "c": "b0d754ec0eba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-35-13-11-16-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788829197, "last_seen": 1788829197, "transport": "t", "ja3_hash": "0edabaaafd3bcde4c830a64929d5fe65", "ja3_variant_count": 1, "ja3_variants": [ "0edabaaafd3bcde4c830a64929d5fe65" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507ht_8daaf6152771_c13c3e2b6bb9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507ht", "b": "8daaf6152771", "c": "c13c3e2b6bb9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-18-65281-51-16-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788835585, "last_seen": 1788835585, "transport": "t", "ja3_hash": "68ddaecefdb9b5863d913ef6f0eda036", "ja3_variant_count": 1, "ja3_variants": [ "68ddaecefdb9b5863d913ef6f0eda036" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507ht_8daaf6152771_d0d5ca1c070a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507ht", "b": "8daaf6152771", "c": "d0d5ca1c070a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-27-35-45-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788846732, "last_seen": 1788846732, "transport": "t", "ja3_hash": "32caf953b8f7e29122b31529fc327599", "ja3_variant_count": 1, "ja3_variants": [ "32caf953b8f7e29122b31529fc327599" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_07ab803c8ed9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "07ab803c8ed9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-17613-65281-35-13-45-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788527463, "last_seen": 1788527463, "transport": "t", "ja3_hash": "a0acd118399f523be06ef62e7ac793e0", "ja3_variant_count": 1, "ja3_variants": [ "a0acd118399f523be06ef62e7ac793e0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_0a10a84c6b38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "0a10a84c6b38", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-27-35-10-45-23-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789896256, "last_seen": 1789896256, "transport": "t", "ja3_hash": "ed043c352233745bff28cdae64d0a436", "ja3_variant_count": 1, "ja3_variants": [ "ed043c352233745bff28cdae64d0a436" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_133bcc6529de", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "133bcc6529de", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-13-35-18-5-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789682266, "last_seen": 1789682266, "transport": "t", "ja3_hash": "4d4ab30fe8df2c50461e5471955c13ed", "ja3_variant_count": 1, "ja3_variants": [ "4d4ab30fe8df2c50461e5471955c13ed" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_2c67da78830a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "2c67da78830a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-65281-13-10-27-23-35,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788889493, "last_seen": 1788889493, "transport": "t", "ja3_hash": "f04760c092d98ce155fa22fe67b6fc5e", "ja3_variant_count": 1, "ja3_variants": [ "f04760c092d98ce155fa22fe67b6fc5e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_30f56f37d2a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "30f56f37d2a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-51-10-27-65281-17613-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788779924, "last_seen": 1788779924, "transport": "t", "ja3_hash": "9df205ebf33b632753c7f13ee63cb68d", "ja3_variant_count": 1, "ja3_variants": [ "9df205ebf33b632753c7f13ee63cb68d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_5173106bc242", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "5173106bc242", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-51-13-65281-10-11-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789451375, "last_seen": 1789451375, "transport": "t", "ja3_hash": "ea62a0f053fd3d41b03785de73f6b19b", "ja3_variant_count": 1, "ja3_variants": [ "ea62a0f053fd3d41b03785de73f6b19b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 43 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_677fdf0ac35f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "677fdf0ac35f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-13-27-65037-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789351033, "last_seen": 1789351033, "transport": "t", "ja3_hash": "a11e3b10cb10312fc449d73e1e6ef218", "ja3_variant_count": 1, "ja3_variants": [ "a11e3b10cb10312fc449d73e1e6ef218" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_69d30f07a8a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "69d30f07a8a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-10-35-27-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788871585, "last_seen": 1788871585, "transport": "t", "ja3_hash": "7dd840efbf562c7056a61e7d129fbb51", "ja3_variant_count": 1, "ja3_variants": [ "7dd840efbf562c7056a61e7d129fbb51" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_6b482c1d5e1d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "6b482c1d5e1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-27-23-18-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789624953, "last_seen": 1789624953, "transport": "t", "ja3_hash": "272afb3b9732ca1461dbe3eec69bce77", "ja3_variant_count": 1, "ja3_variants": [ "272afb3b9732ca1461dbe3eec69bce77" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_706d3b98a2e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "706d3b98a2e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-10-17613-11-65281-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789904946, "last_seen": 1789904946, "transport": "t", "ja3_hash": "b7ca38bade27c41355fc59e27633ea3e", "ja3_variant_count": 1, "ja3_variants": [ "b7ca38bade27c41355fc59e27633ea3e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_7f06c6afa010", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "7f06c6afa010", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-35-65281-18-10-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789329946, "last_seen": 1789329946, "transport": "t", "ja3_hash": "5410544598c603bdbc3304abd67954a5", "ja3_variant_count": 1, "ja3_variants": [ "5410544598c603bdbc3304abd67954a5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_83c448b9062f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "83c448b9062f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-17613-5-35-45-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789091751, "last_seen": 1789091751, "transport": "t", "ja3_hash": "d90e5081eca976e561986c793b77ad76", "ja3_variant_count": 1, "ja3_variants": [ "d90e5081eca976e561986c793b77ad76" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_8e7d22ec80e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "8e7d22ec80e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-10-45-51-5-35-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788739503, "last_seen": 1788739503, "transport": "t", "ja3_hash": "419ddad00db14e5b5cf9d32f5a418fcd", "ja3_variant_count": 1, "ja3_variants": [ "419ddad00db14e5b5cf9d32f5a418fcd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_9c45872a86fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "9c45872a86fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-10-45-13-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788756752, "last_seen": 1788756752, "transport": "t", "ja3_hash": "94cc14d99647032f475218f4c2a43d28", "ja3_variant_count": 1, "ja3_variants": [ "94cc14d99647032f475218f4c2a43d28" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_9ce3660d8fa3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "9ce3660d8fa3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-65281-27-13-65037-10-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789628349, "last_seen": 1789628349, "transport": "t", "ja3_hash": "9508ec9dbdd630440f6efe1700751d46", "ja3_variant_count": 1, "ja3_variants": [ "9508ec9dbdd630440f6efe1700751d46" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_aeb9b8afb0f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "aeb9b8afb0f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-10-5-65281-13-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788846165, "last_seen": 1788846165, "transport": "t", "ja3_hash": "1b8496117271e3795a57a3f0e223a9d3", "ja3_variant_count": 1, "ja3_variants": [ "1b8496117271e3795a57a3f0e223a9d3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_b110d530c50b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "b110d530c50b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-23-51-11-13-27-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789646949, "last_seen": 1789646949, "transport": "t", "ja3_hash": "e353213c7c4f790cfea69eae9fc0d9c2", "ja3_variant_count": 1, "ja3_variants": [ "e353213c7c4f790cfea69eae9fc0d9c2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_b9559a6cf5d7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "b9559a6cf5d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-45-10-18-23-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788491921, "last_seen": 1788491921, "transport": "t", "ja3_hash": "0356024c1067fac94904ca57cace39c1", "ja3_variant_count": 1, "ja3_variants": [ "0356024c1067fac94904ca57cace39c1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_cd090eca95b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "cd090eca95b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-65037-17613-45-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788790047, "last_seen": 1788790047, "transport": "t", "ja3_hash": "bfa4bc2388d0a7f4ba69395decc1524f", "ja3_variant_count": 1, "ja3_variants": [ "bfa4bc2388d0a7f4ba69395decc1524f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_f3340ab47248", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "f3340ab47248", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-35-18-27-65037-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788786673, "last_seen": 1788786673, "transport": "t", "ja3_hash": "48a9cf7809bd44069a8cad14b4722783", "ja3_variant_count": 1, "ja3_variants": [ "48a9cf7809bd44069a8cad14b4722783" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_f90b00670ffd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "f90b00670ffd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-23-35-18-13-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789929465, "last_seen": 1789929465, "transport": "t", "ja3_hash": "700963b2256daddee1a2c7411cabc8b9", "ja3_variant_count": 1, "ja3_variants": [ "700963b2256daddee1a2c7411cabc8b9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; SM-S938B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_24eb3d11256c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "24eb3d11256c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-16-51-17613-65281-5-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788502434, "last_seen": 1788502434, "transport": "t", "ja3_hash": "0d7bf0e5aea7c5e99659ca9d73a0c269", "ja3_variant_count": 1, "ja3_variants": [ "0d7bf0e5aea7c5e99659ca9d73a0c269" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_4d2df2ff6b2e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "4d2df2ff6b2e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-45-65037-16-5-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789457614, "last_seen": 1789457614, "transport": "t", "ja3_hash": "d346da9ef11347482f44b17047a9250a", "ja3_variant_count": 1, "ja3_variants": [ "d346da9ef11347482f44b17047a9250a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_63d7f5ca23a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "63d7f5ca23a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-11-18-65281-27-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789156227, "last_seen": 1789156227, "transport": "t", "ja3_hash": "8c58857b6d93ed87b4b3341728d610e9", "ja3_variant_count": 1, "ja3_variants": [ "8c58857b6d93ed87b4b3341728d610e9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 17 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_708a697806b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "708a697806b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-45-16-27-17613-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789908026, "last_seen": 1789908026, "transport": "t", "ja3_hash": "afba61ca49760e80fb6b6f75bb70b8bc", "ja3_variant_count": 1, "ja3_variants": [ "afba61ca49760e80fb6b6f75bb70b8bc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 5 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_7755c85a546e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "7755c85a546e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-13-23-10-16-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788963197, "last_seen": 1788963197, "transport": "t", "ja3_hash": "d1ee1792019e5561361ff57b2e388f22", "ja3_variant_count": 1, "ja3_variants": [ "d1ee1792019e5561361ff57b2e388f22" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_8935e323e617", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "8935e323e617", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-10-65281-23-35-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789889223, "last_seen": 1789889223, "transport": "t", "ja3_hash": "0d237e38c5ba709b861f49eec4f58c3b", "ja3_variant_count": 1, "ja3_variants": [ "0d237e38c5ba709b861f49eec4f58c3b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_89a9257c738b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "89a9257c738b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-18-45-17613-16-51-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789740972, "last_seen": 1789740972, "transport": "t", "ja3_hash": "afd23485ae9e5d36fe50dcff75247784", "ja3_variant_count": 1, "ja3_variants": [ "afd23485ae9e5d36fe50dcff75247784" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_92cfd8477fba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "92cfd8477fba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-18-10-13-35-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789656740, "last_seen": 1789656740, "transport": "t", "ja3_hash": "bfbb47f792c9d0fa2c0b6b0dc01a8c6e", "ja3_variant_count": 1, "ja3_variants": [ "bfbb47f792c9d0fa2c0b6b0dc01a8c6e" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_ba6f0a2bfb9b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "ba6f0a2bfb9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-51-18-11-23-13-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789455147, "last_seen": 1789455147, "transport": "t", "ja3_hash": "25a8df4957e62951fcd6dc0c91d5dcf9", "ja3_variant_count": 1, "ja3_variants": [ "25a8df4957e62951fcd6dc0c91d5dcf9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 259 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_bb4c9a94ea3e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "bb4c9a94ea3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-18-65037-45-17613-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788825897, "last_seen": 1788825897, "transport": "t", "ja3_hash": "4ece2164ebbbc1689824bc0f2330de94", "ja3_variant_count": 1, "ja3_variants": [ "4ece2164ebbbc1689824bc0f2330de94" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_bc15a4bd39c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "bc15a4bd39c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-18-65281-13-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789051257, "last_seen": 1789051257, "transport": "t", "ja3_hash": "5f34243efde85b3e201028a8e08c31b2", "ja3_variant_count": 1, "ja3_variants": [ "5f34243efde85b3e201028a8e08c31b2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_c50744041d0c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "c50744041d0c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-23-51764-16-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788573746, "last_seen": 1788573746, "transport": "t", "ja3_hash": "33f87219fc3ff33819b51de249af7091", "ja3_variant_count": 1, "ja3_variants": [ "33f87219fc3ff33819b51de249af7091" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_c6d19f5eb9eb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "c6d19f5eb9eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-13-35-65037-16-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789017976, "last_seen": 1789017976, "transport": "t", "ja3_hash": "bb9fc49a3c5ae822d347247405738598", "ja3_variant_count": 1, "ja3_variants": [ "bb9fc49a3c5ae822d347247405738598" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_e09742009b5a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "e09742009b5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-35-18-51-65281-45-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508428, "last_seen": 1788508428, "transport": "t", "ja3_hash": "628c9508bce1b02e57dd9bb5360570ad", "ja3_variant_count": 1, "ja3_variants": [ "628c9508bce1b02e57dd9bb5360570ad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_e17254ee5df5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "e17254ee5df5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-27-51764-17613-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789470325, "last_seen": 1789470325, "transport": "t", "ja3_hash": "a3887506c748ed0fc376212256418848", "ja3_variant_count": 1, "ja3_variants": [ "a3887506c748ed0fc376212256418848" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_e82f445cb9ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "e82f445cb9ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-35-16-18-65281-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789926983, "last_seen": 1789926983, "transport": "t", "ja3_hash": "066b2f57eccdb8318fff5bca17604a98", "ja3_variant_count": 1, "ja3_variants": [ "066b2f57eccdb8318fff5bca17604a98" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_e852850f7c53", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "e852850f7c53", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-23-35-16-18-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788962985, "last_seen": 1788962985, "transport": "t", "ja3_hash": "bbc41490d3b79889f8c35193928258e2", "ja3_variant_count": 1, "ja3_variants": [ "bbc41490d3b79889f8c35193928258e2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_eb88fc84c10b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "eb88fc84c10b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-11-16-65281-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788989623, "last_seen": 1788989623, "transport": "t", "ja3_hash": "c4e90202b136d3fd4df22654ff4a5384", "ja3_variant_count": 1, "ja3_variants": [ "c4e90202b136d3fd4df22654ff4a5384" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508ht_8daaf6152771_017ad424ef22", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508ht", "b": "8daaf6152771", "c": "017ad424ef22", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-45-51-16-13-10-5,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789628362, "last_seen": 1789628362, "transport": "t", "ja3_hash": "22698a1911d3a98648b1d6826a416fc9", "ja3_variant_count": 1, "ja3_variants": [ "22698a1911d3a98648b1d6826a416fc9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508ht_8daaf6152771_44ac823d8afb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508ht", "b": "8daaf6152771", "c": "44ac823d8afb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-45-18-27-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789159986, "last_seen": 1789159986, "transport": "t", "ja3_hash": "aed0df9bc37fd3b2cbb41ce610661275", "ja3_variant_count": 1, "ja3_variants": [ "aed0df9bc37fd3b2cbb41ce610661275" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508ht_8daaf6152771_9d571a0d54b4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508ht", "b": "8daaf6152771", "c": "9d571a0d54b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-16-45-13-35-51-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789819836, "last_seen": 1789819836, "transport": "t", "ja3_hash": "bf61337f8b617aacf3598b404a08a288", "ja3_variant_count": 1, "ja3_variants": [ "bf61337f8b617aacf3598b404a08a288" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508ht_8daaf6152771_b3a10429b150", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508ht", "b": "8daaf6152771", "c": "b3a10429b150", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-13-18-65281-45-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788840357, "last_seen": 1788840357, "transport": "t", "ja3_hash": "77459b7ce19a8a25ceaf104105fe4934", "ja3_variant_count": 1, "ja3_variants": [ "77459b7ce19a8a25ceaf104105fe4934" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508ht_8daaf6152771_b9a266121b5e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508ht", "b": "8daaf6152771", "c": "b9a266121b5e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-16-45-18-23-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788832514, "last_seen": 1788832514, "transport": "t", "ja3_hash": "c5357a629f355db413de2e709270f3d0", "ja3_variant_count": 1, "ja3_variants": [ "c5357a629f355db413de2e709270f3d0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508ht_8daaf6152771_c337d98e7de0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508ht", "b": "8daaf6152771", "c": "c337d98e7de0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-45-35-65037-23-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788862081, "last_seen": 1788862081, "transport": "t", "ja3_hash": "d93099ca9837569a656e896f386b7a0f", "ja3_variant_count": 1, "ja3_variants": [ "d93099ca9837569a656e896f386b7a0f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508ht_8daaf6152771_e7dc12bf7416", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508ht", "b": "8daaf6152771", "c": "e7dc12bf7416", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-11-45-51-27-65281-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788875170, "last_seen": 1788875170, "transport": "t", "ja3_hash": "58ff41dcf2af72c864d416185a123f33", "ja3_variant_count": 1, "ja3_variants": [ "58ff41dcf2af72c864d416185a123f33" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_02706a1fc3bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "02706a1fc3bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-5-51-35-65281-27-11-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789689454, "last_seen": 1789689454, "transport": "t", "ja3_hash": "83cb191cee0bb3575257a54c8ded4bee", "ja3_variant_count": 1, "ja3_variants": [ "83cb191cee0bb3575257a54c8ded4bee" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_13428114bb96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "13428114bb96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-35-17613-18-65281-10-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788628553, "last_seen": 1788628553, "transport": "t", "ja3_hash": "2bc816e06eb552aa58458ab7e64e14dd", "ja3_variant_count": 1, "ja3_variants": [ "2bc816e06eb552aa58458ab7e64e14dd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_1ad7fd5a8478", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "1ad7fd5a8478", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-5-35-27-13-18-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789630982, "last_seen": 1789630982, "transport": "t", "ja3_hash": "27751136dd1919acffe2b975d761b7fc", "ja3_variant_count": 1, "ja3_variants": [ "27751136dd1919acffe2b975d761b7fc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_224d34a5bd55", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "224d34a5bd55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-65281-11-27-18-65037-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789636396, "last_seen": 1789636396, "transport": "t", "ja3_hash": "5a48748bc5294432c9eefa999aed7b4a", "ja3_variant_count": 1, "ja3_variants": [ "5a48748bc5294432c9eefa999aed7b4a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_3d314259149c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "3d314259149c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-27-23-18-11-45-13-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788841885, "last_seen": 1788841885, "transport": "t", "ja3_hash": "fae340d351103dd755df715f0aad08df", "ja3_variant_count": 1, "ja3_variants": [ "fae340d351103dd755df715f0aad08df" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_43e95f82404d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "43e95f82404d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-23-35-11-27-65037-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789217884, "last_seen": 1789217884, "transport": "t", "ja3_hash": "e46568799be65a83293fd070cd2f08e5", "ja3_variant_count": 1, "ja3_variants": [ "e46568799be65a83293fd070cd2f08e5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_45527fb373aa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "45527fb373aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-23-27-11-65281-10-17613-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027525, "last_seen": 1789027525, "transport": "t", "ja3_hash": "c145ec2d9c4fec91c1e9b72c265033d2", "ja3_variant_count": 1, "ja3_variants": [ "c145ec2d9c4fec91c1e9b72c265033d2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_4bfd8e820e7b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "4bfd8e820e7b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-45-65037-17613-5-23-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789963684, "last_seen": 1789963684, "transport": "t", "ja3_hash": "7d0ee1e5c80907a36b7afba975b75dea", "ja3_variant_count": 1, "ja3_variants": [ "7d0ee1e5c80907a36b7afba975b75dea" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_54d289be344e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "54d289be344e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-17613-65281-18-51-13-45-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788826503, "last_seen": 1788826503, "transport": "t", "ja3_hash": "1a919f2cbce36d865ccf7653c85a330b", "ja3_variant_count": 1, "ja3_variants": [ "1a919f2cbce36d865ccf7653c85a330b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_5ebf94746501", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "5ebf94746501", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-17613-18-35-5-23-13-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788739003, "last_seen": 1788739003, "transport": "t", "ja3_hash": "66d7b9de82b4f0526e54842348d7e700", "ja3_variant_count": 1, "ja3_variants": [ "66d7b9de82b4f0526e54842348d7e700" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_74982164794e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "74982164794e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-5-65281-35-65037-18-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789008536, "last_seen": 1789008536, "transport": "t", "ja3_hash": "f2fd6bd83ad773d69e952b589745b92b", "ja3_variant_count": 1, "ja3_variants": [ "f2fd6bd83ad773d69e952b589745b92b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_85ede9c2786f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "85ede9c2786f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-18-51-5-45-11-17613-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788467381, "last_seen": 1788467381, "transport": "t", "ja3_hash": "4b046c00c19ad47f7201718d4fd43ca4", "ja3_variant_count": 1, "ja3_variants": [ "4b046c00c19ad47f7201718d4fd43ca4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 33 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_a236a3e43c99", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "a236a3e43c99", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-17613-27-65281-65037-45-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789027291, "last_seen": 1789027291, "transport": "t", "ja3_hash": "b4ad9ffb0d25fe2dce7b03f1791c037b", "ja3_variant_count": 1, "ja3_variants": [ "b4ad9ffb0d25fe2dce7b03f1791c037b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_a3c42e699f67", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "a3c42e699f67", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-10-11-27-45-65281-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789418253, "last_seen": 1789418253, "transport": "t", "ja3_hash": "26284d809aa9dc2d7ddc48cf80870577", "ja3_variant_count": 1, "ja3_variants": [ "26284d809aa9dc2d7ddc48cf80870577" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 9 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_a8d251cf0c2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "a8d251cf0c2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-11-10-27-23-17613-45-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788888917, "last_seen": 1788888917, "transport": "t", "ja3_hash": "cb235069cd4688ef38314d428942fc48", "ja3_variant_count": 1, "ja3_variants": [ "cb235069cd4688ef38314d428942fc48" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_b021163a18f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "b021163a18f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-5-65281-23-27-13-17613-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788460144, "last_seen": 1788460144, "transport": "t", "ja3_hash": "9f21cc8ed6ba926daabce8629978dd4b", "ja3_variant_count": 1, "ja3_variants": [ "9f21cc8ed6ba926daabce8629978dd4b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_d12988bb14f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "d12988bb14f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-23-65281-11-45-10-35-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789488143, "last_seen": 1789488143, "transport": "t", "ja3_hash": "b95b5b44ea2d33fed875b001c62f871e", "ja3_variant_count": 1, "ja3_variants": [ "b95b5b44ea2d33fed875b001c62f871e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_eecc845b2467", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "eecc845b2467", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-11-13-18-51-23-65281-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788826934, "last_seen": 1788826934, "transport": "t", "ja3_hash": "3c1f856f595831b5ae08aad19bdbf536", "ja3_variant_count": 1, "ja3_variants": [ "3c1f856f595831b5ae08aad19bdbf536" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_043149d10792", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "043149d10792", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-65281-27-5-13-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789691721, "last_seen": 1789691721, "transport": "t", "ja3_hash": "f08729e5c09e7dd2c002a77940b82f44", "ja3_variant_count": 1, "ja3_variants": [ "f08729e5c09e7dd2c002a77940b82f44" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_0713f0201a37", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "0713f0201a37", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-45-10-65037-35-23-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789482727, "last_seen": 1789482727, "transport": "t", "ja3_hash": "c5b86150d8e43be309330b8216d356f9", "ja3_variant_count": 1, "ja3_variants": [ "c5b86150d8e43be309330b8216d356f9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_2070061c9b5f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "2070061c9b5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-5-65281-10-16-45-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789899215, "last_seen": 1789899215, "transport": "t", "ja3_hash": "3a308ec41c97d204b59db923387abcf4", "ja3_variant_count": 1, "ja3_variants": [ "3a308ec41c97d204b59db923387abcf4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 3 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_267ae019230d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "267ae019230d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-51-11-65281-45-16-17513-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788609807, "last_seen": 1788609807, "transport": "t", "ja3_hash": "f4e6d7847e24442666db2dffcbbfce23", "ja3_variant_count": 1, "ja3_variants": [ "f4e6d7847e24442666db2dffcbbfce23" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_2758bf5cf4c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "2758bf5cf4c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-13-23-45-10-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789692900, "last_seen": 1789692900, "transport": "t", "ja3_hash": "18ae7d216ee488f2bdebbebe4508c51a", "ja3_variant_count": 1, "ja3_variants": [ "18ae7d216ee488f2bdebbebe4508c51a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_3ed23afe0d4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "3ed23afe0d4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-51-27-18-23-35-10-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789687636, "last_seen": 1789687636, "transport": "t", "ja3_hash": "3d53b2cce2d1cd98d89c09168d666594", "ja3_variant_count": 1, "ja3_variants": [ "3d53b2cce2d1cd98d89c09168d666594" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_7dd926585955", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "7dd926585955", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-16-17613-11-35-65037-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788573740, "last_seen": 1788573740, "transport": "t", "ja3_hash": "b29f9f144ac641fd571efa5a0947e506", "ja3_variant_count": 1, "ja3_variants": [ "b29f9f144ac641fd571efa5a0947e506" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_81e7cbc761f6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "81e7cbc761f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-35-13-45-18-5-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789768987, "last_seen": 1789768987, "transport": "t", "ja3_hash": "1f1c004dd1914ef8398d8eedf52be3e8", "ja3_variant_count": 1, "ja3_variants": [ "1f1c004dd1914ef8398d8eedf52be3e8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_b125ead79f21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "b125ead79f21", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-16-5-17613-65281-27-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789086302, "last_seen": 1789086302, "transport": "t", "ja3_hash": "4a42bba41314a444ace65ae38f837dd3", "ja3_variant_count": 1, "ja3_variants": [ "4a42bba41314a444ace65ae38f837dd3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_b668ed65f794", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "b668ed65f794", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-13-11-27-10-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789116558, "last_seen": 1789116558, "transport": "t", "ja3_hash": "3ef8f9c7b4e4219142b94c79277556f4", "ja3_variant_count": 1, "ja3_variants": [ "3ef8f9c7b4e4219142b94c79277556f4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_c85a0286aad9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "c85a0286aad9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-23-17613-18-16-5-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789752466, "last_seen": 1789752466, "transport": "t", "ja3_hash": "fb8a01af6eda1f6687475d2b07145e65", "ja3_variant_count": 1, "ja3_variants": [ "fb8a01af6eda1f6687475d2b07145e65" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_d7e7da3d8ae6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "d7e7da3d8ae6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-5-27-18-65037-10-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788773741, "last_seen": 1789749896, "transport": "t", "ja3_hash": "80e6ed681ec7df727cafaad72b1679b0", "ja3_variant_count": 2, "ja3_variants": [ "80e6ed681ec7df727cafaad72b1679b0", "e4240ec6cc4cc020197bfee74fd5b37b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_e79371749d93", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "e79371749d93", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-13-18-27-65281-45-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730712, "last_seen": 1789730712, "transport": "t", "ja3_hash": "6e9d46d33aa8a085fa5c31b6da0bcae8", "ja3_variant_count": 1, "ja3_variants": [ "6e9d46d33aa8a085fa5c31b6da0bcae8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_e981d188a2e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "e981d188a2e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-65037-17613-45-16-65281-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789769762, "last_seen": 1789769762, "transport": "t", "ja3_hash": "f033533832b61905fe7225e5e474dba2", "ja3_variant_count": 1, "ja3_variants": [ "f033533832b61905fe7225e5e474dba2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_f385d413060f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "f385d413060f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-18-23-11-45-13-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789677745, "last_seen": 1789677745, "transport": "t", "ja3_hash": "42a7adc44071fa372ad9f88cef83d8ec", "ja3_variant_count": 1, "ja3_variants": [ "42a7adc44071fa372ad9f88cef83d8ec" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 21 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_ffdfbf7a750e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "ffdfbf7a750e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-18-16-51-11-51764-17613-23,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789936904, "last_seen": 1789936904, "transport": "t", "ja3_hash": "0c6a36a93c6a1a5603fb949cbf978d32", "ja3_variant_count": 1, "ja3_variants": [ "0c6a36a93c6a1a5603fb949cbf978d32" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1509ht_8daaf6152771_bdc196b83cb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509ht", "b": "8daaf6152771", "c": "bdc196b83cb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-65281-27-16-13-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788881054, "last_seen": 1788881054, "transport": "t", "ja3_hash": "b4f75e8ad4f516c8186c5bc5af5a8742", "ja3_variant_count": 1, "ja3_variants": [ "b4f75e8ad4f516c8186c5bc5af5a8742" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_4b41e2769a14", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "4b41e2769a14", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-10-17613-23-27-13-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789849741, "last_seen": 1789849741, "transport": "t", "ja3_hash": "b0406c31de2fbc575cbd5092fdeee4a3", "ja3_variant_count": 1, "ja3_variants": [ "b0406c31de2fbc575cbd5092fdeee4a3" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/136.0 Mobile/15E148 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_550415d7c6f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "550415d7c6f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-45-13-23-17613-10-27-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789012927, "last_seen": 1789012927, "transport": "t", "ja3_hash": "6a7b7aaedc0d1cf646c0bc1746de1b68", "ja3_variant_count": 1, "ja3_variants": [ "6a7b7aaedc0d1cf646c0bc1746de1b68" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 8 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_5af25557be9b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "5af25557be9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-45-5-23-17613-65037-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789687707, "last_seen": 1789687707, "transport": "t", "ja3_hash": "6f9a4014bc5336d7969b7ed714b51c65", "ja3_variant_count": 1, "ja3_variants": [ "6f9a4014bc5336d7969b7ed714b51c65" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_8f205d926981", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "8f205d926981", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-18-17613-23-5-10-65281-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789000017, "last_seen": 1789000017, "transport": "t", "ja3_hash": "faaa098aa30e5039b20538fbf6bae78e", "ja3_variant_count": 1, "ja3_variants": [ "faaa098aa30e5039b20538fbf6bae78e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_03e89b1bfde9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "03e89b1bfde9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-65037-35-10-11-13-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789482817, "last_seen": 1789482817, "transport": "t", "ja3_hash": "5b3a9f06bb4854f040249ef7d5926319", "ja3_variant_count": 1, "ja3_variants": [ "5b3a9f06bb4854f040249ef7d5926319" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_1524f91e48e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "1524f91e48e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-5-11-16-13-45-17613-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788704476, "last_seen": 1788704476, "transport": "t", "ja3_hash": "902102ed9c6c91caf1a2028229a2cda5", "ja3_variant_count": 1, "ja3_variants": [ "902102ed9c6c91caf1a2028229a2cda5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_26d27a2b44d7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "26d27a2b44d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-27-35-51-45-17613-16-18-65281,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788458891, "last_seen": 1788458891, "transport": "t", "ja3_hash": "462782f872f8e5efed573c7e7cb5f5fa", "ja3_variant_count": 1, "ja3_variants": [ "462782f872f8e5efed573c7e7cb5f5fa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_31c5538355e8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "31c5538355e8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-65281-18-27-5-45-51-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789309285, "last_seen": 1789309285, "transport": "t", "ja3_hash": "930c570f4d41876c6fa9e27455855897", "ja3_variant_count": 1, "ja3_variants": [ "930c570f4d41876c6fa9e27455855897" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 69 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_36ee61eab9ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "36ee61eab9ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-16-13-17613-65037-45-11-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789889289, "last_seen": 1789889289, "transport": "t", "ja3_hash": "daae51aab3c52bec1d467cb0d3720144", "ja3_variant_count": 1, "ja3_variants": [ "daae51aab3c52bec1d467cb0d3720144" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_37fac9eb5762", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "37fac9eb5762", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65281-5-23-18-65037-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789811857, "last_seen": 1789811857, "transport": "t", "ja3_hash": "47e2ce8d5952f03daadd195629634a9e", "ja3_variant_count": 1, "ja3_variants": [ "47e2ce8d5952f03daadd195629634a9e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_6d5c674f3f1b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "6d5c674f3f1b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-13-27-45-17613-16-51764-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789732998, "last_seen": 1789732998, "transport": "t", "ja3_hash": "9e566f103cf5ae7b8cc6112aeb8d7f69", "ja3_variant_count": 1, "ja3_variants": [ "9e566f103cf5ae7b8cc6112aeb8d7f69" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_9440e2f5beaa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "9440e2f5beaa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-16-13-11-5-23-27-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723991, "last_seen": 1788723991, "transport": "t", "ja3_hash": "6ec51869818733b42f78b19fbbea87f8", "ja3_variant_count": 1, "ja3_variants": [ "6ec51869818733b42f78b19fbbea87f8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_a1cde03dc164", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "a1cde03dc164", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-65037-27-65281-45-18-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789025922, "last_seen": 1789025922, "transport": "t", "ja3_hash": "1d0c7ef64f4d03b2f2a2ce464e41f3b1", "ja3_variant_count": 1, "ja3_variants": [ "1d0c7ef64f4d03b2f2a2ce464e41f3b1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_af6c2fe9f78f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "af6c2fe9f78f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-16-27-17613-13-23-51764-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789731598, "last_seen": 1789731598, "transport": "t", "ja3_hash": "47161fd30dae8c2ee6b642d447738bee", "ja3_variant_count": 1, "ja3_variants": [ "47161fd30dae8c2ee6b642d447738bee" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_c118ff6a9da0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "c118ff6a9da0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-10-27-16-13-65281-17613-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788747172, "last_seen": 1788747172, "transport": "t", "ja3_hash": "ff752606be90302a5970f86bdcfa68e0", "ja3_variant_count": 1, "ja3_variants": [ "ff752606be90302a5970f86bdcfa68e0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_d25578c35628", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "d25578c35628", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-23-13-65281-11-27-5-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789457573, "last_seen": 1789457573, "transport": "t", "ja3_hash": "085c1fb5a20c067ad016d405dd1dfff6", "ja3_variant_count": 1, "ja3_variants": [ "085c1fb5a20c067ad016d405dd1dfff6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_dd6f794bfbe7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "dd6f794bfbe7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-35-16-5-18-45-11-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789967049, "last_seen": 1789967049, "transport": "t", "ja3_hash": "da35c835a8e5afd31143803a4ae6c5a1", "ja3_variant_count": 1, "ja3_variants": [ "da35c835a8e5afd31143803a4ae6c5a1" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/136.0 Mobile/15E148 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_e2ec9c2c4baa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "e2ec9c2c4baa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-45-18-65037-5-17613-16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024399, "last_seen": 1789024399, "transport": "t", "ja3_hash": "973f9505b999d77aadd2fd01e018bc74", "ja3_variant_count": 1, "ja3_variants": [ "973f9505b999d77aadd2fd01e018bc74" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_fea27915ef95", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "fea27915ef95", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-17613-10-5-65281-13-18-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789656769, "last_seen": 1789656769, "transport": "t", "ja3_hash": "294bb6ef7579181483885ca4554fb3da", "ja3_variant_count": 1, "ja3_variants": [ "294bb6ef7579181483885ca4554fb3da" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510ht_8daaf6152771_ae63d2c559c7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510ht", "b": "8daaf6152771", "c": "ae63d2c559c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-23-18-27-35-45-16-51-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788824540, "last_seen": 1788824540, "transport": "t", "ja3_hash": "b304249accd937e3285a836cbd381cfa", "ja3_variant_count": 1, "ja3_variants": [ "b304249accd937e3285a836cbd381cfa" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510ht_8daaf6152771_b159f50f690a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510ht", "b": "8daaf6152771", "c": "b159f50f690a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-65037-45-35-13-65281-5-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789881754, "last_seen": 1789881754, "transport": "t", "ja3_hash": "5fca47eb76cabb94dcc436db79f4b692", "ja3_variant_count": 1, "ja3_variants": [ "5fca47eb76cabb94dcc436db79f4b692" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151100_8daaf6152771_4f1cc7589a96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151100", "b": "8daaf6152771", "c": "4f1cc7589a96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-35-45-18-27-5-17613-23-11-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788796447, "last_seen": 1788796447, "transport": "t", "ja3_hash": "f0fed604ea3cb5b015ddfe1bdf5cc507", "ja3_variant_count": 1, "ja3_variants": [ "f0fed604ea3cb5b015ddfe1bdf5cc507" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_22948ec5b234", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "22948ec5b234", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-11-35-45-17613-23-16-65037-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788758487, "last_seen": 1788758487, "transport": "t", "ja3_hash": "384a118875baba55b8640134285323db", "ja3_variant_count": 1, "ja3_variants": [ "384a118875baba55b8640134285323db" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_25748c910656", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "25748c910656", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-35-65281-11-18-10-27-17613-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789415694, "last_seen": 1789415694, "transport": "t", "ja3_hash": "45a762c21bb6ac01499286efed084fcc", "ja3_variant_count": 1, "ja3_variants": [ "45a762c21bb6ac01499286efed084fcc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 6 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_528f19b359ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "528f19b359ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-10-17613-65037-45-27-16-18-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789679049, "last_seen": 1789679049, "transport": "t", "ja3_hash": "b8ed7d931a571f9de3a8cb60eba0ac72", "ja3_variant_count": 1, "ja3_variants": [ "b8ed7d931a571f9de3a8cb60eba0ac72" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_5466b74892d6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "5466b74892d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-16-45-10-35-17613-13-18-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789003589, "last_seen": 1789156966, "transport": "t", "ja3_hash": "6650ba84dcef5e88d02fb14a37c96b71", "ja3_variant_count": 2, "ja3_variants": [ "6650ba84dcef5e88d02fb14a37c96b71", "0dbd4b024341a2638ebf2e89830b8fc7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12i1511h2_8daaf6152771_8aacfe6679f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "8aacfe6679f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-65281-18-27-16-5-10-17513-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 37, "first_seen": 1787560651, "last_seen": 1789671446, "transport": "t", "ja3_hash": "e5790367f39dcb56719567b5610a07b1", "ja3_variant_count": 1, "ja3_variants": [ "e5790367f39dcb56719567b5610a07b1" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3983.68 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.2908.6 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3067.24 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_8ecb0990315c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "8ecb0990315c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-65037-10-35-17613-65281-16-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789866427, "last_seen": 1789866427, "transport": "t", "ja3_hash": "84d6ef0e8a74df73a5fbbd62369115c1", "ja3_variant_count": 1, "ja3_variants": [ "84d6ef0e8a74df73a5fbbd62369115c1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_92691750616b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "92691750616b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-23-17613-13-16-18-27-65037-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788926972, "last_seen": 1788926972, "transport": "t", "ja3_hash": "46b987a041925816f3e5a563b84f017f", "ja3_variant_count": 1, "ja3_variants": [ "46b987a041925816f3e5a563b84f017f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_9c098ff40cc6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "9c098ff40cc6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-11-65037-23-16-45-65281-17613-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789775631, "last_seen": 1789775631, "transport": "t", "ja3_hash": "80efd0a76d5096911684180321611dd4", "ja3_variant_count": 1, "ja3_variants": [ "80efd0a76d5096911684180321611dd4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_ca676ff797de", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "ca676ff797de", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-16-35-23-17613-10-11-65281-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789239268, "last_seen": 1789239268, "transport": "t", "ja3_hash": "a0a0fc3f1d29ffb54132320c61e795ae", "ja3_variant_count": 1, "ja3_variants": [ "a0a0fc3f1d29ffb54132320c61e795ae" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_d4c347af123f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "d4c347af123f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-17613-11-65281-35-27-16-65037-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789692954, "last_seen": 1789692954, "transport": "t", "ja3_hash": "d187275ab4baa635a1c7742d6b4482b9", "ja3_variant_count": 1, "ja3_variants": [ "d187275ab4baa635a1c7742d6b4482b9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_ea4c16ac1474", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "ea4c16ac1474", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-65281-10-27-35-45-17613-65037-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789329984, "last_seen": 1789329984, "transport": "t", "ja3_hash": "457ffb6a9db0f7cbae8b445e4ca4c792", "ja3_variant_count": 1, "ja3_variants": [ "457ffb6a9db0f7cbae8b445e4ca4c792" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Vivaldi/7.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_f9f7e2b4a5b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "f9f7e2b4a5b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-27-16-13-5-18-10-65281-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789643464, "last_seen": 1789643464, "transport": "t", "ja3_hash": "a83507566b3231bc064c1a0606fe6db6", "ja3_variant_count": 1, "ja3_variants": [ "a83507566b3231bc064c1a0606fe6db6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 30 }, "ua_disagreement": false } }, { "hash": "t12i1511ht_8daaf6152771_6bf62fea76fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511ht", "b": "8daaf6152771", "c": "6bf62fea76fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-27-13-45-5-11-35-16-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789163343, "last_seen": 1789163343, "transport": "t", "ja3_hash": "fbaa05eabd273b39b241ee762ac503bc", "ja3_variant_count": 1, "ja3_variants": [ "fbaa05eabd273b39b241ee762ac503bc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511ht_8daaf6152771_9a9bca85283b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511ht", "b": "8daaf6152771", "c": "9a9bca85283b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-13-65037-27-10-16-5-18-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788835266, "last_seen": 1788835266, "transport": "t", "ja3_hash": "3bb3a5e119f9ab01a4bd7fec7b2751cc", "ja3_variant_count": 1, "ja3_variants": [ "3bb3a5e119f9ab01a4bd7fec7b2751cc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511ht_8daaf6152771_db50cdee9756", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511ht", "b": "8daaf6152771", "c": "db50cdee9756", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-65037-5-18-13-16-65281-45-10-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789965483, "last_seen": 1789965483, "transport": "t", "ja3_hash": "442542be599ee74689bc4cc20c8026ef", "ja3_variant_count": 1, "ja3_variants": [ "442542be599ee74689bc4cc20c8026ef" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151200_8daaf6152771_01dbc3a6ae3f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151200", "b": "8daaf6152771", "c": "01dbc3a6ae3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-35-45-17613-11-27-65281-65037-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789764190, "last_seen": 1789764190, "transport": "t", "ja3_hash": "680c05b15cf951d7e15d8fad8c1b259e", "ja3_variant_count": 1, "ja3_variants": [ "680c05b15cf951d7e15d8fad8c1b259e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151200_8daaf6152771_62e17c7f19a2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151200", "b": "8daaf6152771", "c": "62e17c7f19a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-13-11-10-65037-65281-27-35-5-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788764656, "last_seen": 1788764656, "transport": "t", "ja3_hash": "eb53235214416ba9c380f047b5c31780", "ja3_variant_count": 1, "ja3_variants": [ "eb53235214416ba9c380f047b5c31780" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i151200_8daaf6152771_854841cf92fd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151200", "b": "8daaf6152771", "c": "854841cf92fd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-17613-35-45-65037-27-18-23-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789682806, "last_seen": 1789682806, "transport": "t", "ja3_hash": "3e83d6d292c871cc3ba1cfaa673744f6", "ja3_variant_count": 1, "ja3_variants": [ "3e83d6d292c871cc3ba1cfaa673744f6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i151200_8daaf6152771_d60dc1ef4431", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151200", "b": "8daaf6152771", "c": "d60dc1ef4431", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-10-18-11-27-65281-5-45-13-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789396325, "last_seen": 1789396325, "transport": "t", "ja3_hash": "f6b06df0cf4b86b628935a84429f9043", "ja3_variant_count": 1, "ja3_variants": [ "f6b06df0cf4b86b628935a84429f9043" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_03bf43fdfbfd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "03bf43fdfbfd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-35-23-27-13-65281-16-10-18-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788804873, "last_seen": 1788804873, "transport": "t", "ja3_hash": "c77262116bb6409b9a7b9df11d1defca", "ja3_variant_count": 1, "ja3_variants": [ "c77262116bb6409b9a7b9df11d1defca" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_0b0d726bf44d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "0b0d726bf44d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-65037-16-45-65281-11-5-18-27-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811258, "last_seen": 1788811258, "transport": "t", "ja3_hash": "2a799cd73b460c5fc53a165db0942faa", "ja3_variant_count": 1, "ja3_variants": [ "2a799cd73b460c5fc53a165db0942faa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_1e73e3036455", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "1e73e3036455", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-18-65281-17613-13-35-27-65037-23-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788449158, "last_seen": 1788449158, "transport": "t", "ja3_hash": "0b2e67b20d1ecc3381251c3b55cb5ffa", "ja3_variant_count": 1, "ja3_variants": [ "0b2e67b20d1ecc3381251c3b55cb5ffa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_d6da472fb599", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "d6da472fb599", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-65037-11-23-13-27-45-5-65281-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788798117, "last_seen": 1788798117, "transport": "t", "ja3_hash": "899ffa730811da5a0300b684b3b81eb2", "ja3_variant_count": 1, "ja3_variants": [ "899ffa730811da5a0300b684b3b81eb2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_e85c5f4ed474", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "e85c5f4ed474", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-11-51764-16-35-5-45-18-10-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508426, "last_seen": 1788508426, "transport": "t", "ja3_hash": "d394fcd983493ff21c7957c51d3e4381", "ja3_variant_count": 1, "ja3_variants": [ "d394fcd983493ff21c7957c51d3e4381" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_fa2ec2b85fde", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "fa2ec2b85fde", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-17613-10-51764-5-35-16-27-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789680310, "last_seen": 1789680310, "transport": "t", "ja3_hash": "8328ba7a0c18658dc9c579a190fa2d46", "ja3_variant_count": 1, "ja3_variants": [ "8328ba7a0c18658dc9c579a190fa2d46" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1512ht_8daaf6152771_c3b22e90674a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512ht", "b": "8daaf6152771", "c": "c3b22e90674a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-16-35-18-10-45-27-65037-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789623549, "last_seen": 1789623549, "transport": "t", "ja3_hash": "7d675db3c60c88c449c59ad0ed83615f", "ja3_variant_count": 1, "ja3_variants": [ "7d675db3c60c88c449c59ad0ed83615f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512ht_8daaf6152771_d24b8a6c63e6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512ht", "b": "8daaf6152771", "c": "d24b8a6c63e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-35-45-65037-10-13-16-5-18-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788831122, "last_seen": 1788831122, "transport": "t", "ja3_hash": "4a43c2663e4a78cb169c605775211bcd", "ja3_variant_count": 1, "ja3_variants": [ "4a43c2663e4a78cb169c605775211bcd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_6ae379a09af0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "6ae379a09af0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-13-51764-45-10-17613-65037-27-35-18-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789572030, "last_seen": 1789572030, "transport": "t", "ja3_hash": "9a9df534b93536f631f8e46c5f888550", "ja3_variant_count": 1, "ja3_variants": [ "9a9df534b93536f631f8e46c5f888550" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_7255178fa4db", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "7255178fa4db", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-5-10-16-65037-13-17613-23-45-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789020785, "last_seen": 1789020785, "transport": "t", "ja3_hash": "1f11604820803f0077cf2fc87c1309ad", "ja3_variant_count": 1, "ja3_variants": [ "1f11604820803f0077cf2fc87c1309ad" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_7f1d323876a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "7f1d323876a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-51764-23-65037-16-11-35-27-18-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469872, "last_seen": 1789469872, "transport": "t", "ja3_hash": "4cf9b4604b37ed0d1b32d93668a7dedb", "ja3_variant_count": 1, "ja3_variants": [ "4cf9b4604b37ed0d1b32d93668a7dedb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_84957e518704", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "84957e518704", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-35-16-13-23-11-10-65281-51764-27-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789480499, "last_seen": 1789480499, "transport": "t", "ja3_hash": "d25f2d65e807a87413d781e7d0459061", "ja3_variant_count": 1, "ja3_variants": [ "d25f2d65e807a87413d781e7d0459061" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_9cc7e60b6689", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "9cc7e60b6689", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51764-65281-23-45-13-11-17613-10-5-65037-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789963694, "last_seen": 1789963694, "transport": "t", "ja3_hash": "06a6ad2f1442f48984802eecf42cfbd0", "ja3_variant_count": 1, "ja3_variants": [ "06a6ad2f1442f48984802eecf42cfbd0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1514h2_8daaf6152771_b4e5cfae9526", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1514h2", "b": "8daaf6152771", "c": "b4e5cfae9526", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-23-11-16-10-18-17613-35-45-65037-5-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789396388, "last_seen": 1789692912, "transport": "t", "ja3_hash": "a4d8b9f4897a00abe1a777453a2e090b", "ja3_variant_count": 2, "ja3_variants": [ "a4d8b9f4897a00abe1a777453a2e090b", "2f2de4160f8b1eac9429c2e770bf2cbd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d021000_3be9a9a201ba_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (17bacd9b6122) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d021000", "b": "3be9a9a201ba", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4869-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825503, "last_seen": 1789615159, "transport": "t", "ja3_hash": "fceaef9317f33a5f61059dadabf8a93c", "ja3_variant_count": 1, "ja3_variants": [ "fceaef9317f33a5f61059dadabf8a93c" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d021000_9d5106e3f751_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (17bacd9b6122) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d021000", "b": "9d5106e3f751", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825503, "last_seen": 1789615158, "transport": "t", "ja3_hash": "fb730716bc8e27a5d2ed322f75409ad9", "ja3_variant_count": 1, "ja3_variants": [ "fb730716bc8e27a5d2ed322f75409ad9" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d021000_bb76221c5b8c_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (17bacd9b6122) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d021000", "b": "bb76221c5b8c", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4867-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825506, "last_seen": 1789615162, "transport": "t", "ja3_hash": "5ad23b5ebbfea380ba05fb724913dc54", "ja3_variant_count": 1, "ja3_variants": [ "5ad23b5ebbfea380ba05fb724913dc54" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d021000_d6df1d7c4cd5_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (17bacd9b6122) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d021000", "b": "d6df1d7c4cd5", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4868-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825502, "last_seen": 1789615157, "transport": "t", "ja3_hash": "833ca94da0fc163d72020670d6d3163f", "ja3_variant_count": 1, "ja3_variants": [ "833ca94da0fc163d72020670d6d3163f" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d021000_ec078ce24869_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (17bacd9b6122) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d021000", "b": "ec078ce24869", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825507, "last_seen": 1789615162, "transport": "t", "ja3_hash": "f1702a92147fe150aaafdcf6a9da1bb0", "ja3_variant_count": 1, "ja3_variants": [ "f1702a92147fe150aaafdcf6a9da1bb0" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d041000_16476d049b0b_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d041000", "b": "16476d049b0b", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 131, "first_seen": 1787509863, "last_seen": 1789900799, "transport": "t", "ja3_hash": "a66e498c488aa0523759691248cdfb01", "ja3_variant_count": 2, "ja3_variants": [ "a66e498c488aa0523759691248cdfb01", "f146948b4a599d4d7ddf071b74696983" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0": 35 }, "ua_disagreement": false } }, { "hash": "t13d0511ht_d55e91d5c3b2_89a737e6a383", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d0511ht", "b": "d55e91d5c3b2", "c": "89a737e6a383", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 5, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-255,0-11-10-35-16-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788706837, "last_seen": 1789364231, "transport": "t", "ja3_hash": "221f0ef85e0fb62a4a14d51238c0b9e2", "ja3_variant_count": 1, "ja3_variants": [ "221f0ef85e0fb62a4a14d51238c0b9e2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 53 }, "ua_disagreement": false } }, { "hash": "t13d061000_a150a9413979_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (17bacd9b6122) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d061000", "b": "a150a9413979", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4869-4868-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 43, "first_seen": 1787509870, "last_seen": 1789900807, "transport": "t", "ja3_hash": "eba4b4f1563f0c39edcb7f1c8c6b0ba5", "ja3_variant_count": 2, "ja3_variants": [ "eba4b4f1563f0c39edcb7f1c8c6b0ba5", "c24c5a4e0080be2e46230b8da7ed452a" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d061100_db2546af4a66_0fe28f4911d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (0fe28f4911d5) with 3 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d061100", "b": "db2546af4a66", "c": "0fe28f4911d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-156-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789354402, "last_seen": 1789618251, "transport": "t", "ja3_hash": "cbe5177af3a7aa151143afcac2238fe2", "ja3_variant_count": 1, "ja3_variants": [ "cbe5177af3a7aa151143afcac2238fe2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 3 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d081300_b8c177e1861e_6c16df1bb63e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d081300", "b": "b8c177e1861e", "c": "6c16df1bb63e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 8, "extension_count": 13, "alpn": null } }, "ja3_string": "771,49196-49195-49199-49200-49171-49172-4865-4866,0-5-10-11-17-23-35-13-43-45-50-51-65281,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1787530140, "last_seen": 1789375021, "transport": "t", "ja3_hash": "c5c01378382959240d01ba60e0359ee3", "ja3_variant_count": 1, "ja3_variants": [ "c5c01378382959240d01ba60e0359ee3" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 29 }, "ua_disagreement": false } }, { "hash": "t13d081400_b8c177e1861e_dea00c3fd0b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d081400", "b": "b8c177e1861e", "c": "dea00c3fd0b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 8, "extension_count": 14, "alpn": null } }, "ja3_string": "771,49196-49195-49199-49200-49171-49172-4865-4866,0-5-10-11-17-23-35-13-43-45-50-51-65281-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1789375030, "last_seen": 1789375072, "transport": "t", "ja3_hash": "9e4312b81305a00e03fb22efc2b07a01", "ja3_variant_count": 1, "ja3_variants": [ "9e4312b81305a00e03fb22efc2b07a01" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d101000_61a7ad8aa9b6_9d6e289b7745", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "9d6e289b7745", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-11-10-13-23-5-0-51-45-35,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788885092, "last_seen": 1788885092, "transport": "t", "ja3_hash": "2924f5c0d0e1ed1d1bd2c3bdca289632", "ja3_variant_count": 1, "ja3_variants": [ "2924f5c0d0e1ed1d1bd2c3bdca289632" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d101000_61a7ad8aa9b6_d5d75a0face9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "d5d75a0face9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-5-10-43-11-13-51-0-23-35,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 128, "first_seen": 1788063549, "last_seen": 1789911758, "transport": "t", "ja3_hash": "b72ad960cb9d86059438605a5470cc61", "ja3_variant_count": 124, "ja3_variants": [ "b72ad960cb9d86059438605a5470cc61", "7b42b1f632bdc93804aec49b2dc2760d", "282e38ded4da6519eeb610385b2cab68", "444af20dba6f899c2d69f25247494115", "321e483bf379444688dda40092e87e97", "870e2ee6e706ee3c0b47523f738e2654", "561082e7153c1bbe707ad6b6d4f86ec9", "624667f006f8290bc4376c2583ffcfde", "78059b42fd685d2e052345994a7aac06", "0a3d53f44be408c5c9a26e9df655425e", "5936e1b5601e011520c49f9cd5de3116", "d59cbf41d399eaee26ec98ac34356e8e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 124, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 3 }, "ua_disagreement": true } }, { "hash": "t13d1010h2_561a47a994ce_b0ef02ef599f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1010h2", "b": "561a47a994ce", "c": "b0ef02ef599f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-49199-157-156-255,0-11-10-16-23-13-43-45-51-21,23-24-29,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 10, "first_seen": 1789368270, "last_seen": 1789912419, "transport": "t", "ja3_hash": "24f5420bdd20ac42df248ae08941bb07", "ja3_variant_count": 1, "ja3_variants": [ "24f5420bdd20ac42df248ae08941bb07" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 81 }, "ua_disagreement": false } }, { "hash": "t13d101100_01be160bb49b_2b2467513d7e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101100", "b": "01be160bb49b", "c": "2b2467513d7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-49200-49199-49192-49191-49196-49195-49188-49187,0-43-13-35-10-11-51-49-23-65281-45,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788499621, "last_seen": 1789575262, "transport": "t", "ja3_hash": "cb128e3474b8e0f4d9f38cba74583436", "ja3_variant_count": 2, "ja3_variants": [ "cb128e3474b8e0f4d9f38cba74583436", "d03ce4f7179484d31e88946bd2f9e639" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5 skype-url-preview@microsoft.com": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1011h2_61a7ad8aa9b6_07a85421bdea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "07a85421bdea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-35-10-11-13-0-45-43-51-5-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 26, "first_seen": 1788140504, "last_seen": 1789930177, "transport": "t", "ja3_hash": "767a42ee55b15c37e76d6d7bba3d730e", "ja3_variant_count": 23, "ja3_variants": [ "767a42ee55b15c37e76d6d7bba3d730e", "546f24426616aeaf811dfba0fc1e80c4", "ebf42a34bbb02164931d90513b5b4327", "c180189d6b115a6b5fe4a7c7c69abaae", "343121395ddbcf703bc6112b38e0a113", "e057df486a2704abee70fccfccf2bbcf", "4c878e1bcdd77fd20f4763c8131d9a7d", "49f4450c3db1d8162f574c9b026910f4", "1df6953d7b1d996d9b5d7b4a763dde29", "8356b8e1ba0b8c136932b571d9790c26", "0d3e41f7143fafcd45ecc670aeffa47d", "0fe4aa59b8e91718a278150752d8b776" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6534.42 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 13; Pixel 7a) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.82 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6540.18 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.141 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15": 2, "Mozilla/5.0 (Linux; Android 12; Redmi Note 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.112 Mobile Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 14; OnePlus 12) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.102 Mobile Safari/537.36": 5, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.76 Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 14; Xiaomi 14 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.33 Mobile Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 14; Samsung SM-A546B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.14 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 16, "Mozilla/5.0 (Linux; Android 11; RMX2195) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.210 Mobile Safari/537.36 OPR/75.2.3995.72468": 2, "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.90 Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1": 4, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.112 Safari/537.36 Brave/1.63.120": 2, "Mozilla/5.0 (Linux; Android 13; Infinix X688B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.48 Mobile Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 11; moto g31) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.96 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edg/128.0.2790.25 Chrome/128.0.6540.22 Safari/537.36": 5, "Mozilla/5.0 (Linux; Android 14; RMX3842) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.44 Mobile Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0 Safari/537.36": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 16_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.7 Mobile/15E148 Safari/604.1": 5, "Mozilla/5.0 (Linux; Android 10; vivo 1904) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.60 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; U; Android 10; en-US; CPH2015) AppleWebKit/537.36 (KHTML, like Gecko) UCBrowser/13.5.8.1311 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 14; SM-A146P) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/25.0 Chrome/123.0.6312.120 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0": 3 }, "ua_disagreement": true } }, { "hash": "t13d1011h2_61a7ad8aa9b6_37eac399f7d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "37eac399f7d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-0-13-11-10-5-23-45-51-43-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 38, "first_seen": 1788480950, "last_seen": 1789803829, "transport": "t", "ja3_hash": "ac53a32cd3329ac3284c6c44e611f904", "ja3_variant_count": 38, "ja3_variants": [ "ac53a32cd3329ac3284c6c44e611f904", "9f6f6dfa8056d023f74bb54d69d69e58", "5eeb04d2e0b53c9dd92689dd2798d880", "5716c979d8995c9746a7bbe1b717d070", "bb1d1076bbd03478f6799c4ecd1bd78f", "970c8baf7b31fe11600e32b3abc468ec", "2d06e705ad69b0769a95504ab35527b0", "14cf0abd5105d1b990d261dc1a55b506", "5f339b53a3e4b80e05e74d16b48c8472", "52e204390f0c7a5180a47a3c2d62fdf4", "d37350c46565f54e89d4af22fca4b826", "14727e8ca969c84187a96ba95e29660b" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 26, "Mozilla/5.0 (compatible; Reflectionbot/1.0; +https://reflection.ai/bot)": 4 }, "ua_disagreement": false } }, { "hash": "t13d1011h2_61a7ad8aa9b6_4086b72c8bfb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (4086b72c8bfb) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "4086b72c8bfb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-49199-52393-52392-255,0-11-10-35-16-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 80, "first_seen": 1788300340, "last_seen": 1789910092, "transport": "t", "ja3_hash": "fda646b797263e0d2c243f19eb6a26ca", "ja3_variant_count": 1, "ja3_variants": [ "fda646b797263e0d2c243f19eb6a26ca" ], "user_agents": { "TerraCotta 0.2 https://www.github.com/ceramicTeam/CeramicTerracotta": 80 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1011h2_9a30925095c0_2f5041364463", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "9a30925095c0", "c": "2f5041364463", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-156-4865-4866-4867,0-11-65281-23-18-5-10-13-16-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788055999, "last_seen": 1789915497, "transport": "t", "ja3_hash": "92e9f8e596cec05cf5471d8692db5019", "ja3_variant_count": 1, "ja3_variants": [ "92e9f8e596cec05cf5471d8692db5019" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1011ht_61a7ad8aa9b6_07a85421bdea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011ht", "b": "61a7ad8aa9b6", "c": "07a85421bdea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-45-43-11-51-35-13-23-0-16-5,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4152, "first_seen": 1787713815, "last_seen": 1789966101, "transport": "t", "ja3_hash": "6235c39d09acfbf422bc32d4b8854681", "ja3_variant_count": 3485, "ja3_variants": [ "6235c39d09acfbf422bc32d4b8854681", "035649ed3561e2c3998b3e580a64358c", "abe478f2645d3ef4b20c01dd261f951f", "fe454f1f939a91e06b56537f1d28b3f6", "ec8c5b74ff02ca7200e4ac0965294663", "b32552e3e4491d5c94149c808a1c7e16", "b2a2e3c74f09ddf9f3a1311515b29d42", "b67a514cfec0118674303fd64c8691f4", "6cbe97fde6b1044ffcad7a592f592e19", "ca591af843a25905ebc3e3e096340f68", "0eaa68151b924e80e667e1adef405c9b", "d5e3d0d6aff302fac95936357bdd2582" ], "user_agents": { "crusader-worker/1.0": 836, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)": 248, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 4638, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 (compatible; AionBot/1.0)": 31, "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)": 163, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 201, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 22, "Mozilla/5.0 (compatible; GitFinder/1.0)": 60, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)": 19, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15": 14, "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.co": 20, "Mozilla/5.0 (Linux; Android 11; moto g31) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.96 Mobile Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:127.0) Gecko/20100101 Firefox/127.0": 2, "PQCrypta-Discovery-Agent/1.0.45": 8, "Mozilla/5.0 (compatible; Google-CloudVertexBot; +https://cloud.google.com/vertex-ai-bot)": 2, "Mozilla/5.0 (compatible; GoogleOther; +https://developers.google.com/search/)": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/136.0.0.0 Mobile/15E148 Safari/604.1": 8, "Mozilla/5.0 (Linux; Android 15; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Mobile Safari/537.36": 7, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 12, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)": 18, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Linux; Android 13; Pixel 7a) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.82 Mobile Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 12; TECNO CK6n) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.50 Mobile Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.76 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186]": 20, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36": 4, "PQCrypta-Discovery-Agent/1.0.38": 14, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (compatible; Applebot/0.1; +http://www.apple.com/go/applebot)": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0": 1, "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1011ht_61a7ad8aa9b6_37eac399f7d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (37eac399f7d8) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1011ht", "b": "61a7ad8aa9b6", "c": "37eac399f7d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-0-43-5-45-16-23-13-51-10-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788686720, "last_seen": 1789291637, "transport": "t", "ja3_hash": "7cc7a01821eb8ee543e2e13aef849380", "ja3_variant_count": 4, "ja3_variants": [ "7cc7a01821eb8ee543e2e13aef849380", "c3e6e3ca8e0543c45c07baa157ab150d", "241b5706d686bafa26f56d5f06bf41f0", "481df1a9b8e5b174a9c8f99f2a81e457" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1011ht_61a7ad8aa9b6_81fd92bdef40", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011ht", "b": "61a7ad8aa9b6", "c": "81fd92bdef40", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-43-5-0-51-45-11-16-13-23-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 451, "first_seen": 1787869891, "last_seen": 1789827717, "transport": "t", "ja3_hash": "0c2f77a338cb1104841db6d75e0e78d7", "ja3_variant_count": 448, "ja3_variants": [ "0c2f77a338cb1104841db6d75e0e78d7", "e0d02e44c6182d83e2886842e41c1c7d", "35a3b6f7cb8361476bb42fcbc2320142", "504aaafd1325326b24f6cb7cd9fcf937", "c723fac79ccbbf6114e2343a8ba40356", "f2b0506443092bd08b4bb4bd8cd2f70d", "98512c260555a8be96eef119bafc2607", "0cbef7d2295e510ab6e218249e096e23", "f2e2ea8cfb09c08194fc87a962174d7f", "68020518166764e180e49d73a22f111d", "4740ac63e73a8fb89be9a34a6ab96c94", "1efa498ea849805fdffaa6c68189e2fc" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 404, "crusader-worker/1.0": 4 }, "ua_disagreement": false } }, { "hash": "t13d1011ht_61a7ad8aa9b6_861bc38b0be4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011ht", "b": "61a7ad8aa9b6", "c": "861bc38b0be4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-45-13-23-16-51-5-43-0-35-11,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 128, "first_seen": 1787465163, "last_seen": 1789951669, "transport": "t", "ja3_hash": "596a34f0f2368a45d51c9242e91b4b8e", "ja3_variant_count": 96, "ja3_variants": [ "596a34f0f2368a45d51c9242e91b4b8e", "a468f17986c4a0107ab8c572312191e6", "3213e59811654f564a92af968f591c53", "eec931821f4ff0eeb766d18318355c17", "1d5a530ba23f6b4a35f9c4b8f6476c42", "26673f4e864d8730e6b78f3e61df6905", "1df29a243abd87e89c829cd34f9fdbe0", "594279bbc8553f098484cfce4bb3478c", "3cbedf1a5aad335e24c3e6aa44df504d", "fff4fd4555d6340435b07e29a1c14128", "6aedb66af3e89dc7089a6b4a7bc9e1a3", "c55f4744bfe95ae9b7544ec5bf4eb272" ], "user_agents": { "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 29, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)": 9, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 15, "crusader-worker/1.0": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; SEOJuice-SearchBot/1.0; +https://seojuice.io/bot": 52, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 19, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 2, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.co": 1, "odin-scanner/0.4": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0": 1 }, "ua_disagreement": true } }, { "hash": "t13d101200_01be160bb49b_d42405ff081a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (d42405ff081a) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d101200", "b": "01be160bb49b", "c": "d42405ff081a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-49200-49199-49192-49191-49196-49195-49188-49187,0-43-13-35-10-11-51-49-23-65281-45-41,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789575262, "last_seen": 1789575263, "transport": "t", "ja3_hash": "c245d98215fa2fc5cd91e404811153a3", "ja3_variant_count": 1, "ja3_variants": [ "c245d98215fa2fc5cd91e404811153a3" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5 skype-url-preview@microsoft.com": 2 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1112ht_dc38fcc760a0_883d66fb079d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1112ht", "b": "dc38fcc760a0", "c": "883d66fb079d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49195-49199-49196-49200-52393-52392-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789138090, "last_seen": 1789138090, "transport": "t", "ja3_hash": "f7e6b1a7c0b79f5ec49f18c3a0ad0f6f", "ja3_variant_count": 1, "ja3_variants": [ "f7e6b1a7c0b79f5ec49f18c3a0ad0f6f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.6779.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1113h2_c5d436628c5c_6da051328960", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (6da051328960) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1113h2", "b": "c5d436628c5c", "c": "6da051328960", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191,65281-0-11-10-35-5-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789412705, "last_seen": 1789544779, "transport": "t", "ja3_hash": "4fd8c5e322a5d6cd14c8dd9842fb7a46", "ja3_variant_count": 1, "ja3_variants": [ "4fd8c5e322a5d6cd14c8dd9842fb7a46" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 88 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d111400_c5d436628c5c_94fdbf49c5a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d111400", "b": "c5d436628c5c", "c": "94fdbf49c5a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191,65281-0-11-10-35-5-22-23-13-43-45-51-27-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789544781, "last_seen": 1789886921, "transport": "t", "ja3_hash": "72904ca78b64c594073f154004c89f6d", "ja3_variant_count": 1, "ja3_variants": [ "72904ca78b64c594073f154004c89f6d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1114h2_5e2a75874763_a001c4a4f8d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1114h2", "b": "5e2a75874763", "c": "a001c4a4f8d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172,0-5-10-11-16-17-23-35-13-43-45-50-51-65281,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 61, "first_seen": 1788928534, "last_seen": 1789531389, "transport": "t", "ja3_hash": "0a80f68631b6e8b4634dbc261e8ba60b", "ja3_variant_count": 2, "ja3_variants": [ "0a80f68631b6e8b4634dbc261e8ba60b", "2ca8118b4937369765242b3fbbc2afcf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 84, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1114h2_a4c8ab769d32_a001c4a4f8d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1114h2", "b": "a4c8ab769d32", "c": "a001c4a4f8d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-158,0-5-10-11-16-17-23-35-13-43-45-50-51-65281,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788382239, "last_seen": 1789683815, "transport": "t", "ja3_hash": "648fd8e625132f2ea6cee9791f5e73c9", "ja3_variant_count": 1, "ja3_variants": [ "648fd8e625132f2ea6cee9791f5e73c9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1114h2_c5d436628c5c_d69a85727d1d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1114h2", "b": "c5d436628c5c", "c": "d69a85727d1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191,65281-0-11-10-35-5-16-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 17, "first_seen": 1789401818, "last_seen": 1789886921, "transport": "t", "ja3_hash": "fc6a00f80c3469f8b779058d9283c761", "ja3_variant_count": 1, "ja3_variants": [ "fc6a00f80c3469f8b779058d9283c761" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 104 }, "ua_disagreement": false } }, { "hash": "t13d1115h2_5e2a75874763_a49342b45e71", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1115h2", "b": "5e2a75874763", "c": "a49342b45e71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172,0-5-10-11-16-17-23-35-13-43-45-50-51-65281-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789317497, "last_seen": 1789317497, "transport": "t", "ja3_hash": "8dde3e838bd806be3dd49190073a7c28", "ja3_variant_count": 1, "ja3_variants": [ "8dde3e838bd806be3dd49190073a7c28" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 53 }, "ua_disagreement": false } }, { "hash": "t13d1115h2_a4c8ab769d32_a49342b45e71", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1115h2", "b": "a4c8ab769d32", "c": "a49342b45e71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-158,0-5-10-11-16-17-23-35-13-43-45-50-51-65281-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789668314, "last_seen": 1789683903, "transport": "t", "ja3_hash": "1f6a374561ef5fd10db280a55944cdd0", "ja3_variant_count": 1, "ja3_variants": [ "1f6a374561ef5fd10db280a55944cdd0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d120900_ed40b14a4398_b229174c0316", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d120900", "b": "ed40b14a4398", "c": "b229174c0316", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-158-159-255,0-11-10-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788463567, "last_seen": 1788463605, "transport": "t", "ja3_hash": "06b77f416ebe634dfdf366b05b0aa469", "ja3_variant_count": 1, "ja3_variants": [ "06b77f416ebe634dfdf366b05b0aa469" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d121100_a538d02d76d5_b2544a34d7f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d121100", "b": "a538d02d76d5", "c": "b2544a34d7f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191-255,0-11-10-35-5-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787558203, "last_seen": 1789179315, "transport": "t", "ja3_hash": "02d7359ba777278df8619c1fd64f71e1", "ja3_variant_count": 1, "ja3_variants": [ "02d7359ba777278df8619c1fd64f71e1" ], "user_agents": { "/": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (compatible; StackScopeBot/1.0; +https://stackscope.dev/bot)": 2 }, "ua_disagreement": false } }, { "hash": "t13d1212ht_a538d02d76d5_4c29f3e0d561", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1212ht", "b": "a538d02d76d5", "c": "4c29f3e0d561", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191-255,0-11-10-35-5-16-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 51, "first_seen": 1787471092, "last_seen": 1789962397, "transport": "t", "ja3_hash": "3dd7722e35af71a5714920be822a2cf8", "ja3_variant_count": 1, "ja3_variants": [ "3dd7722e35af71a5714920be822a2cf8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 48, "Mozilla/5.0 (compatible; DataForSeoBot/1.0; +https://dataforseo.com/dataforseo-bot)": 43, "Mozilla/5.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d131000_f57a46bbacb6_27f0a1fdd87d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131000", "b": "f57a46bbacb6", "c": "27f0a1fdd87d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5366, "first_seen": 1787444206, "last_seen": 1789968237, "transport": "t", "ja3_hash": "8bee49baa010986785a9e74d688ed7e9", "ja3_variant_count": 4, "ja3_variants": [ "8bee49baa010986785a9e74d688ed7e9", "9a382d25aa597efd92d217d84b6eca00", "830b214050a12f72787c1e61e84a6c04", "fe2890151de23c89070fe03e27e6bcf2" ], "user_agents": { "metabase-cve-2026-72898-detect/1.0 (benign detection probes only)": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 10, "AdsNexusBot/1.0": 1, "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)": 96, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 31, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 124, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 480, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36": 156, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36": 368 }, "ua_disagreement": true } }, { "hash": "t13d131100_f57a46bbacb6_0fe28f4911d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131100", "b": "f57a46bbacb6", "c": "0fe28f4911d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7216, "first_seen": 1787442838, "last_seen": 1789967983, "transport": "t", "ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "ja3_variant_count": 2, "ja3_variants": [ "20b279993ae2e137e62b9647c6d768fb", "6aa3e70ad597aeef07e78d50366922c1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Agency/93.8.2357.5": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.3": 14, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Mobile/15E148 Safari/604": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36": 42, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0": 46, "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 5008 }, "ua_disagreement": false } }, { "hash": "t13d131100_f57a46bbacb6_4b7cee5f0569", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131100", "b": "f57a46bbacb6", "c": "4b7cee5f0569", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 21422, "first_seen": 1787443450, "last_seen": 1789968449, "transport": "t", "ja3_hash": "9b7dcdf3f997f1fb7b4409c94cb7ef36", "ja3_variant_count": 6, "ja3_variants": [ "9b7dcdf3f997f1fb7b4409c94cb7ef36", "27073b904a6a7f562e7cf9ccfb774e91", "8451414b0a735c0a73c47f41caf2444d", "e7f86882bd4c6321f5d3475e2e1b017d", "5c4e3d1520f523c80030e4bb4085e740", "d5df8ed14c6aa4b7f756d4a97207974f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (HTML, like Gecko) Mobile Safari/537.36 (compatible; PetalBot;+https://webmaster.petalsearch.com/site/petalbot)": 18761, "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)": 118, "DuckDuckBot/1.1; (+http://duckduckgo.com/duckduckbot.html)": 444, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 3, "Go-http-client/1.1": 1, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 7 }, "ua_disagreement": true } }, { "hash": "t13d1311ht_00f390d99b96_c261ae327436", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1311ht", "b": "00f390d99b96", "c": "c261ae327436", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-13-51-45-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789581466, "last_seen": 1789581466, "transport": "t", "ja3_hash": "67c0d08623276c3b06438c4838e1360e", "ja3_variant_count": 1, "ja3_variants": [ "67c0d08623276c3b06438c4838e1360e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d131200_f57a46bbacb6_849faac7d55e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131200", "b": "f57a46bbacb6", "c": "849faac7d55e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787606022, "last_seen": 1789915071, "transport": "t", "ja3_hash": "da6b59fefd11b7489221a16e8fe89e62", "ja3_variant_count": 1, "ja3_variants": [ "da6b59fefd11b7489221a16e8fe89e62" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1312h2_a44d0ee8b3cc_7c86852a3392", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1312h2", "b": "a44d0ee8b3cc", "c": "7c86852a3392", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49196-49199-49200-49171-156-157-47-53-10,0-23-65281-10-11-35-16-13-51-45-43-21,29-23-24-25-4588-25497-65074,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 65074, "name": "65074 (0xfe32)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 641, "first_seen": 1787444073, "last_seen": 1789961821, "transport": "t", "ja3_hash": "67560f98d68783bd640246df3052c151", "ja3_variant_count": 2, "ja3_variants": [ "67560f98d68783bd640246df3052c151", "5b6568f7bfc663f7e47905a28ff74062" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.7 Safari/537.36": 3, "http://stlweb.dev/wp-admin/install.php?step=1": 46, "http://pqpdf.com/wp-admin/install.php?step=1": 386, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 CloudflareWebScanner/1.0": 80 }, "ua_disagreement": true } }, { "hash": "t13d1312h2_f57a46bbacb6_36b6e4cc52f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1312h2", "b": "f57a46bbacb6", "c": "36b6e4cc52f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1473, "first_seen": 1787451392, "last_seen": 1789968318, "transport": "t", "ja3_hash": "03117a8ed39ef02427ebbc39f121275c", "ja3_variant_count": 3, "ja3_variants": [ "03117a8ed39ef02427ebbc39f121275c", "e69402f870ecf542b4f017b0ed32936a", "b87b027808ec9cc24d4714e78a728853" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36": 8, "Go-http-client/2.0": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 43, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 60, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0": 3, "Slack-ImgProxy (+https://api.slack.com/robots)": 305 }, "ua_disagreement": true } }, { "hash": "t13d1312h2_f57a46bbacb6_b13c6082f84f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1312h2", "b": "f57a46bbacb6", "c": "b13c6082f84f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-16-43-51,25497-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 43, "first_seen": 1787508624, "last_seen": 1789958411, "transport": "t", "ja3_hash": "ed3e096ee0b25c6cc6d45430548096eb", "ja3_variant_count": 1, "ja3_variants": [ "ed3e096ee0b25c6cc6d45430548096eb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 3, "Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_2 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/7.0 Mobile Safari/537.36 (compatible; Bytespider; https://bytedance.sg.larkof": 13, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Bytespider;https://zhanzhang.toutiao.com/": 20 }, "ua_disagreement": false } }, { "hash": "t13d1313h2_f57a46bbacb6_02fd2181c59f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1313h2", "b": "f57a46bbacb6", "c": "02fd2181c59f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-16-43-51-45,25497-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 401, "first_seen": 1787460085, "last_seen": 1789954872, "transport": "t", "ja3_hash": "d3516fb149c297df8b9e80e3d0471e6b", "ja3_variant_count": 1, "ja3_variants": [ "d3516fb149c297df8b9e80e3d0471e6b" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_2 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/7.0 Mobile Safari/537.36 (compatible; Bytespider; https://bytedance.sg.larkof": 164, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 40, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Bytespider;https://zhanzhang.toutiao.com/": 158 }, "ua_disagreement": false } }, { "hash": "t13d1313h2_f57a46bbacb6_9c429092a687", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1313h2", "b": "f57a46bbacb6", "c": "9c429092a687", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-16-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789933074, "last_seen": 1789933074, "transport": "t", "ja3_hash": "81e2f9b0f638109128bd72ffabea460f", "ja3_variant_count": 1, "ja3_variants": [ "81e2f9b0f638109128bd72ffabea460f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1313h2_f57a46bbacb6_fb18a4f6686c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1313h2", "b": "f57a46bbacb6", "c": "fb18a4f6686c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-52393-49199-52392-49162-49161-49172-49171,0-23-65281-10-11-16-5-13-18-51-45-43-27,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 22, "first_seen": 1789323012, "last_seen": 1789677151, "transport": "t", "ja3_hash": "8527da8b8a640065e72ec6b6f99764f3", "ja3_variant_count": 1, "ja3_variants": [ "8527da8b8a640065e72ec6b6f99764f3" ], "user_agents": { "Snagit/2026.98 CFNetwork/3860.600.21 Darwin/25.5.0": 26, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.4 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.4 facebookexternalhit/1.1 Facebot Twitterbot/1.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d1314h2_f57a46bbacb6_1410edd0513f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1314h2", "b": "f57a46bbacb6", "c": "1410edd0513f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-16-43-51-45,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 60, "first_seen": 1789009553, "last_seen": 1789933057, "transport": "t", "ja3_hash": "a15e24f40a90d5cba676dfe012ff2d4a", "ja3_variant_count": 1, "ja3_variants": [ "a15e24f40a90d5cba676dfe012ff2d4a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 101 }, "ua_disagreement": false } }, { "hash": "t13d1314h2_f57a46bbacb6_83d38ed57bc0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1314h2", "b": "f57a46bbacb6", "c": "83d38ed57bc0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-16-43-51-45-41,25497-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 46, "first_seen": 1787601176, "last_seen": 1789680368, "transport": "t", "ja3_hash": "613a531b715c884cc90ac9591a6059b5", "ja3_variant_count": 1, "ja3_variants": [ "613a531b715c884cc90ac9591a6059b5" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Bytespider;https://zhanzhang.toutiao.com/": 46 }, "ua_disagreement": false } }, { "hash": "t13d1315h2_f57a46bbacb6_6695aec2af92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1315h2", "b": "f57a46bbacb6", "c": "6695aec2af92", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-16-43-51-45-41,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1789740906, "last_seen": 1789740908, "transport": "t", "ja3_hash": "95d89cdb32022f73a6a999104183c564", "ja3_variant_count": 1, "ja3_variants": [ "95d89cdb32022f73a6a999104183c564" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d141000_cbb2034c60b8_27f0a1fdd87d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d141000", "b": "cbb2034c60b8", "c": "27f0a1fdd87d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,0-5-10-11-13-65281-23-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 720, "first_seen": 1787520944, "last_seen": 1789963779, "transport": "t", "ja3_hash": "88476a293aeb6f5dc7a3630d391c2980", "ja3_variant_count": 2, "ja3_variants": [ "88476a293aeb6f5dc7a3630d391c2980", "944ced96eb8f08b37bed45951d12594e" ], "user_agents": { "Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity": 3, "Go-http-client/1.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Linux; arm_64; Android 12; CPH2205) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 YaBrowser/23.3.3.86.00 SA/3 Mobile Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 20, "vuln_scanner/3.1.0 (CVE-2026-4020)": 9 }, "ua_disagreement": true } }, { "hash": "t13d1410h2_f98f5dc5c741_b0ef02ef599f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1410h2", "b": "f98f5dc5c741", "c": "b0ef02ef599f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-49199-157-156-49172-49171-53-47-255,0-11-10-16-23-13-43-45-51-21,23-24-29,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 43, "first_seen": 1787836084, "last_seen": 1789377704, "transport": "t", "ja3_hash": "35946cbf409b500b81dca502b65c4139", "ja3_variant_count": 1, "ja3_variants": [ "35946cbf409b500b81dca502b65c4139" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 94, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 534, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 82 }, "ua_disagreement": false } }, { "hash": "t13d141100_cbb2034c60b8_0fe28f4911d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d141100", "b": "cbb2034c60b8", "c": "0fe28f4911d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 111, "first_seen": 1787536738, "last_seen": 1789956076, "transport": "t", "ja3_hash": "6fcb7aa10768c08e39459bf9b7478ab4", "ja3_variant_count": 1, "ja3_variants": [ "6fcb7aa10768c08e39459bf9b7478ab4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1411h2_cbb2034c60b8_2f5041364463", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1411h2", "b": "cbb2034c60b8", "c": "2f5041364463", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,0-5-10-11-13-65281-23-16-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 63, "first_seen": 1787582634, "last_seen": 1789747407, "transport": "t", "ja3_hash": "fd75aaca18604d62f2bc8b02b345140f", "ja3_variant_count": 2, "ja3_variants": [ "fd75aaca18604d62f2bc8b02b345140f", "1aff7135b7ef63d5ab35602cfee4fe08" ], "user_agents": { "Mozilla/5.0 (compatible; AIPostBot/1.0)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36": 2, "Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com)": 55, "PipericBot/1.0 (+https://piperic.com/bot)": 24 }, "ua_disagreement": false } }, { "hash": "t13d1411h2_f98f5dc5c741_43244b3c42a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1411h2", "b": "f98f5dc5c741", "c": "43244b3c42a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49199-49196-49200-49171-49172-156-157-47-53-255,0-11-10-35-16-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789931521, "last_seen": 1789931521, "transport": "t", "ja3_hash": "3da8794700f3c16cffc6e95a30e25b0b", "ja3_variant_count": 1, "ja3_variants": [ "3da8794700f3c16cffc6e95a30e25b0b" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ABEvalBot/0.1) Version/11.1.2 Safari/605.1.15": 9 }, "ua_disagreement": false } }, { "hash": "t13d1411ht_3241d5e7d676_757c955fe60b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1411ht", "b": "3241d5e7d676", "c": "757c955fe60b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49161-49195-49196-49171-49172-49199-49200-47-53-156-157,0-23-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789052690, "last_seen": 1789052691, "transport": "t", "ja3_hash": "dd47f038750d2ebfd245a325daf39fb5", "ja3_variant_count": 1, "ja3_variants": [ "dd47f038750d2ebfd245a325daf39fb5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 18 }, "ua_disagreement": false } }, { "hash": "t13d1413h2_cbb2034c60b8_02fd2181c59f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (02fd2181c59f) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1413h2", "b": "cbb2034c60b8", "c": "02fd2181c59f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,0-5-10-11-35-13-65281-23-16-18-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789777345, "last_seen": 1789777345, "transport": "t", "ja3_hash": "486df75fc4af1573cc1dd10925179ff4", "ja3_variant_count": 1, "ja3_variants": [ "486df75fc4af1573cc1dd10925179ff4" ], "user_agents": { "sellsybot/1.0 (+mailto:dev@sellsy.com)": 3 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1414ht_cbb2034c60b8_5cfd0277bcfd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1414ht", "b": "cbb2034c60b8", "c": "5cfd0277bcfd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-16-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 51, "first_seen": 1787471859, "last_seen": 1788570598, "transport": "t", "ja3_hash": "e13341638f1239c92909f490b08d5b74", "ja3_variant_count": 1, "ja3_variants": [ "e13341638f1239c92909f490b08d5b74" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:127.0) Gecko/20100101 Firefox/127.0": 11, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 30 }, "ua_disagreement": false } }, { "hash": "t13d1415ht_cbb2034c60b8_3052c9156dc4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1415ht", "b": "cbb2034c60b8", "c": "3052c9156dc4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 15, "alpn": "ht" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-16-43-51-45-41,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787471864, "last_seen": 1788539560, "transport": "t", "ja3_hash": "9b7eaffae07c43baf9ab33e59012bf9f", "ja3_variant_count": 1, "ja3_variants": [ "9b7eaffae07c43baf9ab33e59012bf9f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d150400_8daaf6152771_6395773a0331", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150400", "b": "8daaf6152771", "c": "6395773a0331", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789782783, "last_seen": 1789782783, "transport": "t", "ja3_hash": "2876134be8e2b31d44aca951a5405feb", "ja3_variant_count": 1, "ja3_variants": [ "2876134be8e2b31d44aca951a5405feb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d150400_8daaf6152771_65583ff04902", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150400", "b": "8daaf6152771", "c": "65583ff04902", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789455861, "last_seen": 1789455861, "transport": "t", "ja3_hash": "22b149a3c1431166b7e04a0725af9843", "ja3_variant_count": 1, "ja3_variants": [ "22b149a3c1431166b7e04a0725af9843" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150400_8daaf6152771_793c12383e39", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150400", "b": "8daaf6152771", "c": "793c12383e39", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788973026, "last_seen": 1788973026, "transport": "t", "ja3_hash": "e3368a82ebc912309455b4e606fa7ef8", "ja3_variant_count": 1, "ja3_variants": [ "e3368a82ebc912309455b4e606fa7ef8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_98a7beea59bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "98a7beea59bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789633635, "last_seen": 1789633635, "transport": "t", "ja3_hash": "40564364b76a383102c47647c0206976", "ja3_variant_count": 1, "ja3_variants": [ "40564364b76a383102c47647c0206976" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_c79d6c8945ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "c79d6c8945ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-65281-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788767830, "last_seen": 1788767830, "transport": "t", "ja3_hash": "85b2d556966b520ec30fb50bab4a2719", "ja3_variant_count": 1, "ja3_variants": [ "85b2d556966b520ec30fb50bab4a2719" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_fcfc74e37280", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "fcfc74e37280", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-13-43-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788847124, "last_seen": 1788847124, "transport": "t", "ja3_hash": "d36ac886b39f68e8b8fc02c723b68282", "ja3_variant_count": 1, "ja3_variants": [ "d36ac886b39f68e8b8fc02c723b68282" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1505h2_8daaf6152771_6c0a99cc6402", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1505h2", "b": "8daaf6152771", "c": "6c0a99cc6402", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-16-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789791002, "last_seen": 1789791002, "transport": "t", "ja3_hash": "01ff4fe865f89721f4d7b79b64a3384e", "ja3_variant_count": 1, "ja3_variants": [ "01ff4fe865f89721f4d7b79b64a3384e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_08841029404f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "08841029404f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-43-27-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789309293, "last_seen": 1789965863, "transport": "t", "ja3_hash": "993c441ae238c16f4ccc81f549eeed95", "ja3_variant_count": 2, "ja3_variants": [ "993c441ae238c16f4ccc81f549eeed95", "a24ce0136118afaf8735b21051c7ca0b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_0c11a4eb7702", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "0c11a4eb7702", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-43-35-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788756549, "last_seen": 1788756549, "transport": "t", "ja3_hash": "a23b77dcaad90edc81684345fb188e2d", "ja3_variant_count": 1, "ja3_variants": [ "a23b77dcaad90edc81684345fb188e2d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_12bf9c0e3530", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "12bf9c0e3530", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-18-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789008614, "last_seen": 1789008614, "transport": "t", "ja3_hash": "26114ed3899b79ab059978678f4a042c", "ja3_variant_count": 1, "ja3_variants": [ "26114ed3899b79ab059978678f4a042c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_3bd3a522d002", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "3bd3a522d002", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-0-43-11-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789623814, "last_seen": 1789623814, "transport": "t", "ja3_hash": "e7f642621728b6ab0e238f9ceb6bbfdd", "ja3_variant_count": 1, "ja3_variants": [ "e7f642621728b6ab0e238f9ceb6bbfdd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_5337dc83306a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "5337dc83306a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-0-27-43-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788881427, "last_seen": 1788881427, "transport": "t", "ja3_hash": "24939f506ab4c6b039fd942cf564651f", "ja3_variant_count": 1, "ja3_variants": [ "24939f506ab4c6b039fd942cf564651f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_5d3571b4b177", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "5d3571b4b177", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-43-18-13-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789006561, "last_seen": 1789006561, "transport": "t", "ja3_hash": "63bced1deae20c4edf126f6fb321be14", "ja3_variant_count": 1, "ja3_variants": [ "63bced1deae20c4edf126f6fb321be14" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 4 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_5e2d4a56324a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "5e2d4a56324a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-10-13-11-51,514-4588-24-23-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789201599, "last_seen": 1789201599, "transport": "t", "ja3_hash": "8fff960d0cd0c2344158390289bee305", "ja3_variant_count": 1, "ja3_variants": [ "8fff960d0cd0c2344158390289bee305" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_6ce2c773f3ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "6ce2c773f3ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-17613-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788740500, "last_seen": 1788740500, "transport": "t", "ja3_hash": "307cd0c2acf93dfe845319d032deb4f8", "ja3_variant_count": 1, "ja3_variants": [ "307cd0c2acf93dfe845319d032deb4f8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_6db434393cb9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "6db434393cb9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-65281-43-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788530035, "last_seen": 1788530035, "transport": "t", "ja3_hash": "c3df9fc5ef5dfcbfd8fac45110db1e53", "ja3_variant_count": 1, "ja3_variants": [ "c3df9fc5ef5dfcbfd8fac45110db1e53" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_a01fa3adfb96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "a01fa3adfb96", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-43-51-0-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789845095, "last_seen": 1789845095, "transport": "t", "ja3_hash": "5da3b1bd6db0901d34b5e056f4e279a5", "ja3_variant_count": 1, "ja3_variants": [ "5da3b1bd6db0901d34b5e056f4e279a5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 19 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_c02a7a5970fb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "c02a7a5970fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-43-5-51-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789628956, "last_seen": 1789628956, "transport": "t", "ja3_hash": "1cab11e6c170045ed4a2fa78dc07fc19", "ja3_variant_count": 1, "ja3_variants": [ "1cab11e6c170045ed4a2fa78dc07fc19" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_e068b723aa3d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "e068b723aa3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-0-43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789681301, "last_seen": 1789681301, "transport": "t", "ja3_hash": "0cc41d34a8e23fc9b6828d9ab5487147", "ja3_variant_count": 1, "ja3_variants": [ "0cc41d34a8e23fc9b6828d9ab5487147" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_d1abf05d0e7e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "d1abf05d0e7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-35-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788781702, "last_seen": 1788781702, "transport": "t", "ja3_hash": "603b7f75d95da9027ebae22f7235d69a", "ja3_variant_count": 1, "ja3_variants": [ "603b7f75d95da9027ebae22f7235d69a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_3df1326d0b5a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "3df1326d0b5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-18-51-43-11-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788731573, "last_seen": 1788731573, "transport": "t", "ja3_hash": "1b56eb4ac316c35d225285c1308e797f", "ja3_variant_count": 1, "ja3_variants": [ "1b56eb4ac316c35d225285c1308e797f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_3ea645034b4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "3ea645034b4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-23-43-65281-0-45,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788521182, "last_seen": 1788521182, "transport": "t", "ja3_hash": "d1a13a9ca1d0497013e494958ec0c3e4", "ja3_variant_count": 1, "ja3_variants": [ "d1a13a9ca1d0497013e494958ec0c3e4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_4970460b490a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "4970460b490a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-0-11-43-51-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789881541, "last_seen": 1789881541, "transport": "t", "ja3_hash": "092626e815f2f02495c50eacb2e65a65", "ja3_variant_count": 1, "ja3_variants": [ "092626e815f2f02495c50eacb2e65a65" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_643b03e972d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "643b03e972d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-23-27-45-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788564901, "last_seen": 1788564901, "transport": "t", "ja3_hash": "f74f516057d41fae633d8b89644bd178", "ja3_variant_count": 1, "ja3_variants": [ "f74f516057d41fae633d8b89644bd178" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_7156dfa78d42", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "7156dfa78d42", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-35-43-27-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789124467, "last_seen": 1789124467, "transport": "t", "ja3_hash": "a4a0629c86ff3c8582c3004d15ec5f58", "ja3_variant_count": 1, "ja3_variants": [ "a4a0629c86ff3c8582c3004d15ec5f58" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 20 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_8ac6097fa65b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "8ac6097fa65b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-27-35-5-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788888857, "last_seen": 1788888857, "transport": "t", "ja3_hash": "164f44fc313dd876a062e48b0ae2050a", "ja3_variant_count": 1, "ja3_variants": [ "164f44fc313dd876a062e48b0ae2050a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_8f622c51302a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "8f622c51302a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-65281-0-13-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788571460, "last_seen": 1788571460, "transport": "t", "ja3_hash": "21a18ddb12482357df5130774c9a2e83", "ja3_variant_count": 1, "ja3_variants": [ "21a18ddb12482357df5130774c9a2e83" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_9ee38d8fd5e5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "9ee38d8fd5e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-18-17613-0-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788782931, "last_seen": 1788782931, "transport": "t", "ja3_hash": "0a45117f30da3db51111afaa13ef468f", "ja3_variant_count": 1, "ja3_variants": [ "0a45117f30da3db51111afaa13ef468f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_9fa51bad6b80", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "9fa51bad6b80", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-45-0-43-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788444969, "last_seen": 1788444969, "transport": "t", "ja3_hash": "4e40923bcd3f4b169ccd83311da1f3a9", "ja3_variant_count": 1, "ja3_variants": [ "4e40923bcd3f4b169ccd83311da1f3a9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_cbd15a882afb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "cbd15a882afb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-23-5-43-51-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789671196, "last_seen": 1789671196, "transport": "t", "ja3_hash": "83c35fc13d3341d4c7fd206b5a66be26", "ja3_variant_count": 1, "ja3_variants": [ "83c35fc13d3341d4c7fd206b5a66be26" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_d7148763b69b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "d7148763b69b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-5-45-51-43-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789669045, "last_seen": 1789669045, "transport": "t", "ja3_hash": "819512efdb1ff3d1b55997002adb921c", "ja3_variant_count": 1, "ja3_variants": [ "819512efdb1ff3d1b55997002adb921c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_f49448a39853", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "f49448a39853", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-10-43-51-0-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789883878, "last_seen": 1789883878, "transport": "t", "ja3_hash": "3c4a7309858fdd6983f76b9edd859c11", "ja3_variant_count": 1, "ja3_variants": [ "3c4a7309858fdd6983f76b9edd859c11" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_1316e5f84d4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "1316e5f84d4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-5-27-43-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789419114, "last_seen": 1789419114, "transport": "t", "ja3_hash": "24f2b45814c951b4b9e689a30b2e406e", "ja3_variant_count": 1, "ja3_variants": [ "24f2b45814c951b4b9e689a30b2e406e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_7d807eb1274d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "7d807eb1274d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-65281-17613-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789697333, "last_seen": 1789697333, "transport": "t", "ja3_hash": "a073d720f19910be7e38fddca91c7a45", "ja3_variant_count": 1, "ja3_variants": [ "a073d720f19910be7e38fddca91c7a45" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4 }, "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_e2d0642d3468", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "e2d0642d3468", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-5-0-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789505659, "last_seen": 1789505659, "transport": "t", "ja3_hash": "4c5fe39c1f4dc82fed065af63769f930", "ja3_variant_count": 1, "ja3_variants": [ "4c5fe39c1f4dc82fed065af63769f930" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_f321f6fe1b55", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "f321f6fe1b55", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-0-5-16-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788530021, "last_seen": 1788530021, "transport": "t", "ja3_hash": "027af4ab8128bcb94c1bec3f60bdc8d2", "ja3_variant_count": 1, "ja3_variants": [ "027af4ab8128bcb94c1bec3f60bdc8d2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1507ht_8daaf6152771_1cd4d616b311", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507ht", "b": "8daaf6152771", "c": "1cd4d616b311", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-23-16-10-0-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788864956, "last_seen": 1788864956, "transport": "t", "ja3_hash": "049801594a8c9c8cb3c0cac0870a8b0e", "ja3_variant_count": 1, "ja3_variants": [ "049801594a8c9c8cb3c0cac0870a8b0e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1507ht_8daaf6152771_294f8cfe83f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507ht", "b": "8daaf6152771", "c": "294f8cfe83f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-27-51-0-16-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788846723, "last_seen": 1788846723, "transport": "t", "ja3_hash": "070f2fc7544068c9d4c93f0e31c15780", "ja3_variant_count": 1, "ja3_variants": [ "070f2fc7544068c9d4c93f0e31c15780" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_091b5ffd8da5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "091b5ffd8da5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-13-11-45-43-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789138245, "last_seen": 1789138245, "transport": "t", "ja3_hash": "ed72e7920f586adf65b0f4db48baea44", "ja3_variant_count": 1, "ja3_variants": [ "ed72e7920f586adf65b0f4db48baea44" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_1f7cd0ed21c4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "1f7cd0ed21c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-0-65281-43-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788792037, "last_seen": 1788792037, "transport": "t", "ja3_hash": "e5ac03ad04c97ff504942d28205f078f", "ja3_variant_count": 1, "ja3_variants": [ "e5ac03ad04c97ff504942d28205f078f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_27804b92cf38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "27804b92cf38", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-65281-35-5-65037-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789697458, "last_seen": 1789697458, "transport": "t", "ja3_hash": "c66362aa5eec97bee211cdb6479ed66b", "ja3_variant_count": 1, "ja3_variants": [ "c66362aa5eec97bee211cdb6479ed66b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_2bedaf58f8f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "2bedaf58f8f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-43-65037-35-5-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788875546, "last_seen": 1788875546, "transport": "t", "ja3_hash": "dc352fcdc9c09937903b9e8241028f97", "ja3_variant_count": 1, "ja3_variants": [ "dc352fcdc9c09937903b9e8241028f97" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_39e4abd14154", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "39e4abd14154", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-65281-13-65037-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788850319, "last_seen": 1788850319, "transport": "t", "ja3_hash": "393d89fbf9119458318ddec4c4676a92", "ja3_variant_count": 1, "ja3_variants": [ "393d89fbf9119458318ddec4c4676a92" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_3c1d35c4ea2e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "3c1d35c4ea2e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-27-18-0-65037-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788777986, "last_seen": 1788777986, "transport": "t", "ja3_hash": "9b62561b6e7162678a9d426b0b4456e7", "ja3_variant_count": 1, "ja3_variants": [ "9b62561b6e7162678a9d426b0b4456e7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 5 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_46333065d5e5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "46333065d5e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-13-17613-0-65281-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789848495, "last_seen": 1789848495, "transport": "t", "ja3_hash": "acadc26dfd63569c55b6aa17f3662aab", "ja3_variant_count": 1, "ja3_variants": [ "acadc26dfd63569c55b6aa17f3662aab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_5bafd1a579bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "5bafd1a579bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-0-11-45-35-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788889117, "last_seen": 1788889117, "transport": "t", "ja3_hash": "42589ac23df7ce7cf1eb1fa06e8f9ae4", "ja3_variant_count": 1, "ja3_variants": [ "42589ac23df7ce7cf1eb1fa06e8f9ae4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_5edb5201e160", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "5edb5201e160", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-11-65037-17613-0-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789707038, "last_seen": 1789707038, "transport": "t", "ja3_hash": "43d640e44b331dcf0a9788d9db3c72e8", "ja3_variant_count": 1, "ja3_variants": [ "43d640e44b331dcf0a9788d9db3c72e8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_69ecb552dea4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "69ecb552dea4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-35-18-43-17613-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789108595, "last_seen": 1789108595, "transport": "t", "ja3_hash": "850d736b9e0c2b6ebfd93d59d0f2ae7b", "ja3_variant_count": 1, "ja3_variants": [ "850d736b9e0c2b6ebfd93d59d0f2ae7b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_776b4972314e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "776b4972314e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-43-5-0-65037-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788604995, "last_seen": 1788604995, "transport": "t", "ja3_hash": "fad937961f3f54d413c36f5e6f55cf98", "ja3_variant_count": 1, "ja3_variants": [ "fad937961f3f54d413c36f5e6f55cf98" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_7bc938ec63f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "7bc938ec63f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-45-23-43-27-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788820899, "last_seen": 1788820899, "transport": "t", "ja3_hash": "a004c3641186a09fcf06fe39176c2ba8", "ja3_variant_count": 1, "ja3_variants": [ "a004c3641186a09fcf06fe39176c2ba8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_8b200a1390a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "8b200a1390a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-23-10-43-0-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788991205, "last_seen": 1788991205, "transport": "t", "ja3_hash": "e399e07c784dee65bf7d1202092532be", "ja3_variant_count": 1, "ja3_variants": [ "e399e07c784dee65bf7d1202092532be" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_a31a3607aba1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "a31a3607aba1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-43-17613-0-51-35-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811261, "last_seen": 1788811261, "transport": "t", "ja3_hash": "772fbc266e1400be8602c00512425a97", "ja3_variant_count": 1, "ja3_variants": [ "772fbc266e1400be8602c00512425a97" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_a4c1aa2a9521", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "a4c1aa2a9521", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-65037-45-65281-18-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789415656, "last_seen": 1789415656, "transport": "t", "ja3_hash": "7ae3205f38e51e8753da6d3945018b63", "ja3_variant_count": 1, "ja3_variants": [ "7ae3205f38e51e8753da6d3945018b63" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_b3ca4e5e7e8c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "b3ca4e5e7e8c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-10-0-45-23-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788552996, "last_seen": 1788552996, "transport": "t", "ja3_hash": "977dffb09be8306aabd83cc39706f6d3", "ja3_variant_count": 1, "ja3_variants": [ "977dffb09be8306aabd83cc39706f6d3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_cb271997266a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "cb271997266a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-27-18-45-51-11-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788833629, "last_seen": 1788833629, "transport": "t", "ja3_hash": "bcfa7caa59e5d9b114cdf1ff4a871416", "ja3_variant_count": 1, "ja3_variants": [ "bcfa7caa59e5d9b114cdf1ff4a871416" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_cc7ba10103f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "cc7ba10103f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-5-0-10-45-43-23,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788724246, "last_seen": 1788724246, "transport": "t", "ja3_hash": "241b46aee87b7caed08b9a9acc8691d6", "ja3_variant_count": 1, "ja3_variants": [ "241b46aee87b7caed08b9a9acc8691d6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_d3b842ac4282", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "d3b842ac4282", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-23-51-43-18-65281-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789735702, "last_seen": 1789735702, "transport": "t", "ja3_hash": "4ef461a943b659f67a504e134b55701d", "ja3_variant_count": 1, "ja3_variants": [ "4ef461a943b659f67a504e134b55701d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_386d3a552a71", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "386d3a552a71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-23-43-18-16-27-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788811261, "last_seen": 1788811261, "transport": "t", "ja3_hash": "cb1f8985e61283a17e8e3358767e3dc6", "ja3_variant_count": 1, "ja3_variants": [ "cb1f8985e61283a17e8e3358767e3dc6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_647822cbe0b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "647822cbe0b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-0-23-18-43-51-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789651391, "last_seen": 1789651391, "transport": "t", "ja3_hash": "58ac40f8170f91af53fe3ac1b3e5a592", "ja3_variant_count": 1, "ja3_variants": [ "58ac40f8170f91af53fe3ac1b3e5a592" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_700e7196a7bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "700e7196a7bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-11-43-23-27-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788625334, "last_seen": 1788625334, "transport": "t", "ja3_hash": "387611f6320ea86d26bdfeb660ba08cc", "ja3_variant_count": 1, "ja3_variants": [ "387611f6320ea86d26bdfeb660ba08cc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_7dd074c0a900", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "7dd074c0a900", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-43-10-0-18-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788856458, "last_seen": 1788856458, "transport": "t", "ja3_hash": "7a9f2cbc3621a1e9ed85e1b7a0776c77", "ja3_variant_count": 1, "ja3_variants": [ "7a9f2cbc3621a1e9ed85e1b7a0776c77" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_c0d2f195bc20", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "c0d2f195bc20", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-10-11-13-16-23-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789146032, "last_seen": 1789146306, "transport": "t", "ja3_hash": "442b3545972f2507309b65d26bea590e", "ja3_variant_count": 1, "ja3_variants": [ "442b3545972f2507309b65d26bea590e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_f4690e350745", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "f4690e350745", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-11-13-16-23-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 206, "first_seen": 1787519937, "last_seen": 1789448532, "transport": "t", "ja3_hash": "afe8d9ad42fcbd57b861ac2c485fab64", "ja3_variant_count": 1, "ja3_variants": [ "afe8d9ad42fcbd57b861ac2c485fab64" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 655, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1810 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_ff3c0ed93428", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "ff3c0ed93428", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-16-65037-18-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789015003, "last_seen": 1789015003, "transport": "t", "ja3_hash": "7f04035fc12337ce2f145cc302ea1eff", "ja3_variant_count": 1, "ja3_variants": [ "7f04035fc12337ce2f145cc302ea1eff" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508ht_8daaf6152771_01250b79134e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508ht", "b": "8daaf6152771", "c": "01250b79134e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-23-10-0-18-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788848978, "last_seen": 1788848978, "transport": "t", "ja3_hash": "48f4dd0129af51060783e805c5d004b7", "ja3_variant_count": 1, "ja3_variants": [ "48f4dd0129af51060783e805c5d004b7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508ht_8daaf6152771_293b30b5b3f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508ht", "b": "8daaf6152771", "c": "293b30b5b3f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-13-10-5-0-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788829561, "last_seen": 1788829561, "transport": "t", "ja3_hash": "887cdb0b9a1cc21aff92c1f34cc5e398", "ja3_variant_count": 1, "ja3_variants": [ "887cdb0b9a1cc21aff92c1f34cc5e398" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508ht_8daaf6152771_43efa75a9bb9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508ht", "b": "8daaf6152771", "c": "43efa75a9bb9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-16-18-5-23-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788844565, "last_seen": 1788844565, "transport": "t", "ja3_hash": "27a20a82e84be0c669db6c14fb4ccdf0", "ja3_variant_count": 1, "ja3_variants": [ "27a20a82e84be0c669db6c14fb4ccdf0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508ht_8daaf6152771_71ce8eed8da8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508ht", "b": "8daaf6152771", "c": "71ce8eed8da8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-16-11-0-10-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788832504, "last_seen": 1788832504, "transport": "t", "ja3_hash": "62ec7d3c53e71878105811d6e7be21e0", "ja3_variant_count": 1, "ja3_variants": [ "62ec7d3c53e71878105811d6e7be21e0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508ht_8daaf6152771_d9e8a20a2fe1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508ht", "b": "8daaf6152771", "c": "d9e8a20a2fe1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-27-16-43-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788823175, "last_seen": 1788823175, "transport": "t", "ja3_hash": "eed790457c33672210f56e35ec9d10fa", "ja3_variant_count": 1, "ja3_variants": [ "eed790457c33672210f56e35ec9d10fa" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_01ed16fe7a24", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "01ed16fe7a24", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-45-43-65281-27-13-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788841767, "last_seen": 1788841767, "transport": "t", "ja3_hash": "1eb079dccd727c93adc7366b6724db75", "ja3_variant_count": 1, "ja3_variants": [ "1eb079dccd727c93adc7366b6724db75" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_177a6b31bbf9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "177a6b31bbf9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-45-0-23-27-10-18-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789635417, "last_seen": 1789635417, "transport": "t", "ja3_hash": "c9dbd9824136bb0e82677ea864e8a496", "ja3_variant_count": 1, "ja3_variants": [ "c9dbd9824136bb0e82677ea864e8a496" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_1f0fa7178733", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "1f0fa7178733", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-11-45-27-65037-43-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789750238, "last_seen": 1789750238, "transport": "t", "ja3_hash": "f65fb479d4a81a901c05c3d7776d2bb4", "ja3_variant_count": 1, "ja3_variants": [ "f65fb479d4a81a901c05c3d7776d2bb4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_2d8b4f23cbf9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "2d8b4f23cbf9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-0-27-45-51-23-43-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024342, "last_seen": 1789024342, "transport": "t", "ja3_hash": "e0143f07c4730aa3803112a00905769d", "ja3_variant_count": 1, "ja3_variants": [ "e0143f07c4730aa3803112a00905769d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 18 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_3139a3fc29c4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "3139a3fc29c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-10-13-51764-5-0-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789751591, "last_seen": 1789751591, "transport": "t", "ja3_hash": "2c42b65c965bd4f467029591eb8c1cdc", "ja3_variant_count": 1, "ja3_variants": [ "2c42b65c965bd4f467029591eb8c1cdc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_33b5fa156c07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "33b5fa156c07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-17613-18-13-27-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789898058, "last_seen": 1789898058, "transport": "t", "ja3_hash": "1ca03e42d7cfa24b984d9c0702f6ab46", "ja3_variant_count": 1, "ja3_variants": [ "1ca03e42d7cfa24b984d9c0702f6ab46" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_4e9f51966537", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "4e9f51966537", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-13-45-5-23-0-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789058943, "last_seen": 1789058943, "transport": "t", "ja3_hash": "df703f5b3124a35017d407b2138e3c9e", "ja3_variant_count": 1, "ja3_variants": [ "df703f5b3124a35017d407b2138e3c9e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_54bdc124d96d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "54bdc124d96d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-65037-45-23-43-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789022590, "last_seen": 1789022590, "transport": "t", "ja3_hash": "2542f9232cf5b7bb07ff7c8ba006e58a", "ja3_variant_count": 1, "ja3_variants": [ "2542f9232cf5b7bb07ff7c8ba006e58a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_60dcc1284d2b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "60dcc1284d2b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-13-0-17613-43-65037-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788771535, "last_seen": 1788771535, "transport": "t", "ja3_hash": "9f3ce1dc47ccc64ff783e887461f8040", "ja3_variant_count": 1, "ja3_variants": [ "9f3ce1dc47ccc64ff783e887461f8040" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_6eae12bf6194", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "6eae12bf6194", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-27-45-0-43-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789008721, "last_seen": 1789701459, "transport": "t", "ja3_hash": "610df90204c1e30a48b368db71478421", "ja3_variant_count": 2, "ja3_variants": [ "610df90204c1e30a48b368db71478421", "01d8bb400fc1aabd4cc849ed857d6b01" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_7acf5cc4c480", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "7acf5cc4c480", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-65281-35-5-51-45-27-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789381291, "last_seen": 1789381291, "transport": "t", "ja3_hash": "a3faa30823c40d9c50db0bbb13f902ea", "ja3_variant_count": 1, "ja3_variants": [ "a3faa30823c40d9c50db0bbb13f902ea" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_8a8763b36db7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "8a8763b36db7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-27-11-0-18-17613-51-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789253281, "last_seen": 1789253281, "transport": "t", "ja3_hash": "64128570dabc9a738ef1ac89e7dcd184", "ja3_variant_count": 1, "ja3_variants": [ "64128570dabc9a738ef1ac89e7dcd184" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Safari/605.1.15": 2 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_9299e92064c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "9299e92064c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-0-23-10-43-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789966800, "last_seen": 1789966800, "transport": "t", "ja3_hash": "bc6fe27022bf1553f8c82944333e618e", "ja3_variant_count": 1, "ja3_variants": [ "bc6fe27022bf1553f8c82944333e618e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_a83a7c8280ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "a83a7c8280ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-23-43-45-65281-13-5-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789163954, "last_seen": 1789163954, "transport": "t", "ja3_hash": "72fe3645ead2001614243607e0256a98", "ja3_variant_count": 1, "ja3_variants": [ "72fe3645ead2001614243607e0256a98" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_a98bbcc5bc28", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "a98bbcc5bc28", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-17613-43-23-27-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789214372, "last_seen": 1789214372, "transport": "t", "ja3_hash": "4eb0d4b41b4ac6dfe052c195f7fc2bd8", "ja3_variant_count": 1, "ja3_variants": [ "4eb0d4b41b4ac6dfe052c195f7fc2bd8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_ad5424c46727", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "ad5424c46727", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-27-65037-35-43-5-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788825783, "last_seen": 1788825783, "transport": "t", "ja3_hash": "b1e44f9777eaaaefe162274174de37d8", "ja3_variant_count": 1, "ja3_variants": [ "b1e44f9777eaaaefe162274174de37d8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_ae7534c0c424", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "ae7534c0c424", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-0-11-17613-65281-27-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789096320, "last_seen": 1789096320, "transport": "t", "ja3_hash": "74f7c72479b5dbf09dd6052bf9cf21d2", "ja3_variant_count": 1, "ja3_variants": [ "74f7c72479b5dbf09dd6052bf9cf21d2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_b6b443f6192d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "b6b443f6192d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-5-35-10-43-65037-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789693039, "last_seen": 1789693039, "transport": "t", "ja3_hash": "409a69b4807d7f0bf27144cb35a44e5d", "ja3_variant_count": 1, "ja3_variants": [ "409a69b4807d7f0bf27144cb35a44e5d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_c901a5b4defe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "c901a5b4defe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-43-65037-0-65281-45-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788807326, "last_seen": 1788807326, "transport": "t", "ja3_hash": "01676dac3b397c9849f86d0c865f4d99", "ja3_variant_count": 1, "ja3_variants": [ "01676dac3b397c9849f86d0c865f4d99" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_e68c4ed1a086", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "e68c4ed1a086", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-0-35-11-5-43-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789207836, "last_seen": 1789207836, "transport": "t", "ja3_hash": "d6814bf6d02bec6fd7e6d03ecf196860", "ja3_variant_count": 1, "ja3_variants": [ "d6814bf6d02bec6fd7e6d03ecf196860" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_e935b566eaef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "e935b566eaef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-43-35-0-45-27-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788773212, "last_seen": 1788773212, "transport": "t", "ja3_hash": "5efd5194e4925caa4864fc7765bb3af1", "ja3_variant_count": 1, "ja3_variants": [ "5efd5194e4925caa4864fc7765bb3af1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_f25e528dacd2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "f25e528dacd2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-43-5-10-45-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788783140, "last_seen": 1788783140, "transport": "t", "ja3_hash": "22877f7b897c93b1d3cfb70995a1fb47", "ja3_variant_count": 1, "ja3_variants": [ "22877f7b897c93b1d3cfb70995a1fb47" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_29e0a2c968b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "29e0a2c968b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-65281-16-35-5-13-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789010560, "last_seen": 1789010560, "transport": "t", "ja3_hash": "dab0e03ccd37dc2dbb63dbeca63d1454", "ja3_variant_count": 1, "ja3_variants": [ "dab0e03ccd37dc2dbb63dbeca63d1454" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_2b3496e8f2c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "2b3496e8f2c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-16-27-10-18-5-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789689140, "last_seen": 1789689140, "transport": "t", "ja3_hash": "ed307f1da50f716146d941e18aaa5ceb", "ja3_variant_count": 1, "ja3_variants": [ "ed307f1da50f716146d941e18aaa5ceb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_45951111fdb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "45951111fdb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-16-45-43-0-27-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788822996, "last_seen": 1788822996, "transport": "t", "ja3_hash": "765a6d93df82dcdb8018fb20cbb90008", "ja3_variant_count": 1, "ja3_variants": [ "765a6d93df82dcdb8018fb20cbb90008" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_49e7b9e70e8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "49e7b9e70e8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-16-17613-45-5-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789946655, "last_seen": 1789946655, "transport": "t", "ja3_hash": "76b86965623dff497a32511b91913d90", "ja3_variant_count": 1, "ja3_variants": [ "76b86965623dff497a32511b91913d90" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_545fbee21e2c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "545fbee21e2c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-16-13-65037-10-5-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788769137, "last_seen": 1788769137, "transport": "t", "ja3_hash": "d3ebd3219ab77c99af8559c287615a70", "ja3_variant_count": 1, "ja3_variants": [ "d3ebd3219ab77c99af8559c287615a70" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_714425a3fe8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "714425a3fe8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-16-5-43-0-18-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788637367, "last_seen": 1788637367, "transport": "t", "ja3_hash": "cc370c0b32864cf25a7041c4a2dd1f25", "ja3_variant_count": 1, "ja3_variants": [ "cc370c0b32864cf25a7041c4a2dd1f25" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_d00fbc7e2486", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "d00fbc7e2486", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-43-17613-10-16-45-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788846277, "last_seen": 1788846277, "transport": "t", "ja3_hash": "2983a2a0fa6c6ab0bd451d75f15b662d", "ja3_variant_count": 1, "ja3_variants": [ "2983a2a0fa6c6ab0bd451d75f15b662d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_d2d94938909d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "d2d94938909d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-35-17613-0-16-43-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789384909, "last_seen": 1789384909, "transport": "t", "ja3_hash": "d797f6add7d458660212391fd5f4caae", "ja3_variant_count": 1, "ja3_variants": [ "d797f6add7d458660212391fd5f4caae" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 48 }, "ua_disagreement": false } }, { "hash": "t13d1509ht_8daaf6152771_266405fda146", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509ht", "b": "8daaf6152771", "c": "266405fda146", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-23-13-35-45-0-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789631276, "last_seen": 1789631276, "transport": "t", "ja3_hash": "95d70d2989d83fb7282ab6dbeab550ec", "ja3_variant_count": 1, "ja3_variants": [ "95d70d2989d83fb7282ab6dbeab550ec" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509ht_8daaf6152771_52e411b08136", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509ht", "b": "8daaf6152771", "c": "52e411b08136", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-16-43-23-0-35-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789624667, "last_seen": 1789624667, "transport": "t", "ja3_hash": "4aec74c9458746b0126497dc0d2de7ae", "ja3_variant_count": 1, "ja3_variants": [ "4aec74c9458746b0126497dc0d2de7ae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509ht_8daaf6152771_554f31aaf619", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509ht", "b": "8daaf6152771", "c": "554f31aaf619", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-16-23-11-65281-0-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789152177, "last_seen": 1789152177, "transport": "t", "ja3_hash": "4c9aedef5f284ee26dae42df4d3e2b74", "ja3_variant_count": 1, "ja3_variants": [ "4c9aedef5f284ee26dae42df4d3e2b74" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509ht_8daaf6152771_57a3d0da5a03", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509ht", "b": "8daaf6152771", "c": "57a3d0da5a03", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-0-65281-65037-10-43-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788871590, "last_seen": 1788871590, "transport": "t", "ja3_hash": "025c8ce7396e71e15a7b77d69c008b22", "ja3_variant_count": 1, "ja3_variants": [ "025c8ce7396e71e15a7b77d69c008b22" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509ht_8daaf6152771_69ae8ce2a9c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509ht", "b": "8daaf6152771", "c": "69ae8ce2a9c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-65281-11-0-45-16-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788850082, "last_seen": 1788850082, "transport": "t", "ja3_hash": "8ffba108b90878e90cb059dd5e32d9ce", "ja3_variant_count": 1, "ja3_variants": [ "8ffba108b90878e90cb059dd5e32d9ce" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509ht_8daaf6152771_d35fbdc386aa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509ht", "b": "8daaf6152771", "c": "d35fbdc386aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-0-35-16-65281-18-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789878936, "last_seen": 1789878936, "transport": "t", "ja3_hash": "19cd2b0cb8ee8fe91a1db371a8e5e3b8", "ja3_variant_count": 1, "ja3_variants": [ "19cd2b0cb8ee8fe91a1db371a8e5e3b8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_0a19e4678e5f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "0a19e4678e5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-65037-13-0-23-18-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789637719, "last_seen": 1789637719, "transport": "t", "ja3_hash": "db02292e094947c2d6d0e1bb5d5c33a8", "ja3_variant_count": 1, "ja3_variants": [ "db02292e094947c2d6d0e1bb5d5c33a8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_0fb015de9b9e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "0fb015de9b9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-35-13-17613-11-0-43-23-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789729318, "last_seen": 1789729318, "transport": "t", "ja3_hash": "44e16dead07fdc1da591cfbaa7d57374", "ja3_variant_count": 1, "ja3_variants": [ "44e16dead07fdc1da591cfbaa7d57374" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_312153169968", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "312153169968", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-51-18-23-27-65281-43-17613-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789543667, "last_seen": 1789543667, "transport": "t", "ja3_hash": "7de2139fce87380092800063c8915a3a", "ja3_variant_count": 1, "ja3_variants": [ "7de2139fce87380092800063c8915a3a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 78 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_439bde0fe37e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "439bde0fe37e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-18-65281-13-10-45-0-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788829537, "last_seen": 1788829537, "transport": "t", "ja3_hash": "0a475ec9a651e730b6abf64c46b662ab", "ja3_variant_count": 1, "ja3_variants": [ "0a475ec9a651e730b6abf64c46b662ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_670a174695a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "670a174695a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-43-23-10-13-45-65037-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789653255, "last_seen": 1789653255, "transport": "t", "ja3_hash": "f37a6b0dd0a35a536d2e1b6e9f949a60", "ja3_variant_count": 1, "ja3_variants": [ "f37a6b0dd0a35a536d2e1b6e9f949a60" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_7c8bf02b2b19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "7c8bf02b2b19", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-10-45-11-43-5-0-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788800433, "last_seen": 1788800433, "transport": "t", "ja3_hash": "bda3173455605a4dc0936aeab84e11c9", "ja3_variant_count": 1, "ja3_variants": [ "bda3173455605a4dc0936aeab84e11c9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_a859a99fb925", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "a859a99fb925", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-0-13-43-11-35-23-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788848134, "last_seen": 1788848134, "transport": "t", "ja3_hash": "97440e2282d4987906903f446ea68275", "ja3_variant_count": 1, "ja3_variants": [ "97440e2282d4987906903f446ea68275" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_a9fc2cfb70dc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "a9fc2cfb70dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-0-65281-11-23-18-43-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788763600, "last_seen": 1788763600, "transport": "t", "ja3_hash": "3d1e801b650b006c39351d727660d88a", "ja3_variant_count": 1, "ja3_variants": [ "3d1e801b650b006c39351d727660d88a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_aefab1b5c69c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "aefab1b5c69c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-10-11-35-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 111, "first_seen": 1787501960, "last_seen": 1789951917, "transport": "t", "ja3_hash": "773454095eae22d82b441a3d5fd38f2c", "ja3_variant_count": 1, "ja3_variants": [ "773454095eae22d82b441a3d5fd38f2c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 104 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_b1d8b2d7768c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "b1d8b2d7768c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-11-43-51-18-45-27-0-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788646502, "last_seen": 1788646502, "transport": "t", "ja3_hash": "ddc7cc2a98f0e6d2425e64dcc8ea3bdf", "ja3_variant_count": 1, "ja3_variants": [ "ddc7cc2a98f0e6d2425e64dcc8ea3bdf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_c17802dd9d2f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "c17802dd9d2f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-23-43-5-11-17613-18-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788777737, "last_seen": 1788777737, "transport": "t", "ja3_hash": "ba3c493808b22ada0954b65361495ef5", "ja3_variant_count": 1, "ja3_variants": [ "ba3c493808b22ada0954b65361495ef5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_c7956fbd5a3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "c7956fbd5a3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-17613-10-5-18-11-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789811528, "last_seen": 1789811528, "transport": "t", "ja3_hash": "bdf9040637621a3e39e2fbee1ac682dd", "ja3_variant_count": 1, "ja3_variants": [ "bdf9040637621a3e39e2fbee1ac682dd" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 4 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_cc6f402e9645", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "cc6f402e9645", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-65037-10-43-65281-0-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788766531, "last_seen": 1788766531, "transport": "t", "ja3_hash": "04d0450fa6b0d33bc60092949343d0a8", "ja3_variant_count": 1, "ja3_variants": [ "04d0450fa6b0d33bc60092949343d0a8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_cc966371b891", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "cc966371b891", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-65037-43-27-11-35-18-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789139677, "last_seen": 1789139677, "transport": "t", "ja3_hash": "a906e342f80447ed893a331087b37683", "ja3_variant_count": 1, "ja3_variants": [ "a906e342f80447ed893a331087b37683" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_ce9115b133e8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "ce9115b133e8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-0-5-35-23-11-18-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788823624, "last_seen": 1788823624, "transport": "t", "ja3_hash": "fd4a9e71844daaa8143087deeb1365ef", "ja3_variant_count": 1, "ja3_variants": [ "fd4a9e71844daaa8143087deeb1365ef" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 20 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_df2c812e45a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "df2c812e45a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-43-23-27-10-35-13-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788889496, "last_seen": 1788889496, "transport": "t", "ja3_hash": "2c7b5ee47a8784024e6b4860b2c47e60", "ja3_variant_count": 1, "ja3_variants": [ "2c7b5ee47a8784024e6b4860b2c47e60" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_e090d4e4a727", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "e090d4e4a727", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-45-27-11-43-13-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789118208, "last_seen": 1789118208, "transport": "t", "ja3_hash": "a642b4118a27a1bba7bc171a7881a4fa", "ja3_variant_count": 1, "ja3_variants": [ "a642b4118a27a1bba7bc171a7881a4fa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_e6d2f66b5ddd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "e6d2f66b5ddd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-43-11-27-23-45-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789235998, "last_seen": 1789235998, "transport": "t", "ja3_hash": "a7346a297bccb3880825c8976b4fd98d", "ja3_variant_count": 1, "ja3_variants": [ "a7346a297bccb3880825c8976b4fd98d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 269 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_fd3fae43409d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "fd3fae43409d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-0-65281-5-43-45-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789199766, "last_seen": 1789199766, "transport": "t", "ja3_hash": "8c1cfc81ff454f18a7537c1f3fd8a084", "ja3_variant_count": 1, "ja3_variants": [ "8c1cfc81ff454f18a7537c1f3fd8a084" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_0097c4617540", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "0097c4617540", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-16-43-18-65037-0-27-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788787069, "last_seen": 1788787069, "transport": "t", "ja3_hash": "9619dcf06874686c882cc9c9dd891641", "ja3_variant_count": 1, "ja3_variants": [ "9619dcf06874686c882cc9c9dd891641" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_024097c4f251", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "024097c4f251", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-11-13-16-23-43-51-65281-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1010, "first_seen": 1787519937, "last_seen": 1789571767, "transport": "t", "ja3_hash": "f93e221ff54567d63c32136b7f1b40a2", "ja3_variant_count": 2, "ja3_variants": [ "f93e221ff54567d63c32136b7f1b40a2", "c2d6ee96a384947ed9ffab9aea3ecc5b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 77, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2053, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 31, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_1caa804f6aed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "1caa804f6aed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-27-35-43-65281-18-16-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789070272, "last_seen": 1789070272, "transport": "t", "ja3_hash": "60f3ab1cefc6b46be7615b217179703c", "ja3_variant_count": 1, "ja3_variants": [ "60f3ab1cefc6b46be7615b217179703c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_224276210b97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "224276210b97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-0-23-65037-16-18-27-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788703790, "last_seen": 1788703790, "transport": "t", "ja3_hash": "6f1bf0c5c237576e4b373df02090dbb8", "ja3_variant_count": 1, "ja3_variants": [ "6f1bf0c5c237576e4b373df02090dbb8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_3820c08d9b29", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "3820c08d9b29", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-65281-0-16-27-43-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788782101, "last_seen": 1788782101, "transport": "t", "ja3_hash": "9a65e65a9cd82c022d2a25ed8bb05f86", "ja3_variant_count": 1, "ja3_variants": [ "9a65e65a9cd82c022d2a25ed8bb05f86" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_385f0cf05797", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "385f0cf05797", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-13-5-43-0-17613-16-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789752929, "last_seen": 1789752929, "transport": "t", "ja3_hash": "47f2f51e42897cc32b7595a006d8573b", "ja3_variant_count": 1, "ja3_variants": [ "47f2f51e42897cc32b7595a006d8573b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_49ea69128b21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "49ea69128b21", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,16-11-43-35-18-0-17613-5-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789719617, "last_seen": 1789719617, "transport": "t", "ja3_hash": "78620f19f5f4a482e16e8706adba800d", "ja3_variant_count": 1, "ja3_variants": [ "78620f19f5f4a482e16e8706adba800d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_5cc8e47cb800", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "5cc8e47cb800", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-10-11-13-16-23-43-51-65281-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1787693736, "last_seen": 1789146303, "transport": "t", "ja3_hash": "f2fa9ccaf82656bb0fe6560cff4b0e69", "ja3_variant_count": 1, "ja3_variants": [ "f2fa9ccaf82656bb0fe6560cff4b0e69" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 17 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_6ba760eed02f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "6ba760eed02f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-18-43-16-13-0-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789912225, "last_seen": 1789912225, "transport": "t", "ja3_hash": "24fdc59b94956f0cdc7f261cde76a6b5", "ja3_variant_count": 1, "ja3_variants": [ "24fdc59b94956f0cdc7f261cde76a6b5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_763cee2d13aa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "763cee2d13aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-43-13-65037-0-16-65281-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788459875, "last_seen": 1788459875, "transport": "t", "ja3_hash": "7396dbd7a58c01bcecc16d2e3dcca373", "ja3_variant_count": 1, "ja3_variants": [ "7396dbd7a58c01bcecc16d2e3dcca373" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_7738f8652c44", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "7738f8652c44", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-18-13-17613-35-45-16-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788644552, "last_seen": 1788644552, "transport": "t", "ja3_hash": "415ff11702c0092f74244f4bd2d6af15", "ja3_variant_count": 1, "ja3_variants": [ "415ff11702c0092f74244f4bd2d6af15" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_8cb294dcfa71", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "8cb294dcfa71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-23-10-0-16-43-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788832112, "last_seen": 1788832112, "transport": "t", "ja3_hash": "7fa7e35972c0509a2a8f8abaa1337243", "ja3_variant_count": 1, "ja3_variants": [ "7fa7e35972c0509a2a8f8abaa1337243" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_962d460064af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "962d460064af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-5-11-43-65281-0-27-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789843713, "last_seen": 1789843713, "transport": "t", "ja3_hash": "c8da74970829fa20950f476a204ff685", "ja3_variant_count": 1, "ja3_variants": [ "c8da74970829fa20950f476a204ff685" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_9d48eeabca4d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "9d48eeabca4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-13-43-18-10-0-17613-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789457567, "last_seen": 1789457567, "transport": "t", "ja3_hash": "e4e8dc203d6b19005b861d05b91b5b41", "ja3_variant_count": 1, "ja3_variants": [ "e4e8dc203d6b19005b861d05b91b5b41" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_c3bd72be5ba3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "c3bd72be5ba3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-0-10-16-11-13-65281-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789681817, "last_seen": 1789681817, "transport": "t", "ja3_hash": "6752ee8930e6e12d597a4f1e1e353947", "ja3_variant_count": 1, "ja3_variants": [ "6752ee8930e6e12d597a4f1e1e353947" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_c8b7a43fbf54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "c8b7a43fbf54", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-0-43-35-23-27-17613-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789064040, "last_seen": 1789064040, "transport": "t", "ja3_hash": "e7fb42f5c55de5eeb0ef490347f6f1fd", "ja3_variant_count": 1, "ja3_variants": [ "e7fb42f5c55de5eeb0ef490347f6f1fd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_cd9215fcbba7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "cd9215fcbba7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-23-65281-0-5-43-16-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788781380, "last_seen": 1788781380, "transport": "t", "ja3_hash": "8b0037f6ce5efb3b5b7fddb7ff79f54a", "ja3_variant_count": 1, "ja3_variants": [ "8b0037f6ce5efb3b5b7fddb7ff79f54a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_f037a32b9ade", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "f037a32b9ade", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-17613-18-23-43-65281-65037-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788990725, "last_seen": 1788990725, "transport": "t", "ja3_hash": "4d53bb470815e341cf4b3ba47a7a3fb2", "ja3_variant_count": 1, "ja3_variants": [ "4d53bb470815e341cf4b3ba47a7a3fb2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510ht_8daaf6152771_3e1e5eacdaa9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510ht", "b": "8daaf6152771", "c": "3e1e5eacdaa9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-10-16-0-23-35-45-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789152772, "last_seen": 1789152772, "transport": "t", "ja3_hash": "fce35bb0593ee9562e57780ad3e73b5c", "ja3_variant_count": 1, "ja3_variants": [ "fce35bb0593ee9562e57780ad3e73b5c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510ht_8daaf6152771_73c5745ef636", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510ht", "b": "8daaf6152771", "c": "73c5745ef636", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-16-35-0-13-11-27-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788840319, "last_seen": 1788840319, "transport": "t", "ja3_hash": "1597d8d0c3560d0c47d717d1f559e9ac", "ja3_variant_count": 1, "ja3_variants": [ "1597d8d0c3560d0c47d717d1f559e9ac" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510ht_8daaf6152771_745ce9e4dbaa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510ht", "b": "8daaf6152771", "c": "745ce9e4dbaa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-11-0-35-16-5-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788851855, "last_seen": 1788851855, "transport": "t", "ja3_hash": "b7f84fb80bb5823ba486ac7fb56b2f95", "ja3_variant_count": 1, "ja3_variants": [ "b7f84fb80bb5823ba486ac7fb56b2f95" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510ht_8daaf6152771_872496debd7e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510ht", "b": "8daaf6152771", "c": "872496debd7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-0-27-35-65281-43-5-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788823554, "last_seen": 1788823554, "transport": "t", "ja3_hash": "57cd77ebad8b88161796b1defb237e99", "ja3_variant_count": 1, "ja3_variants": [ "57cd77ebad8b88161796b1defb237e99" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510ht_8daaf6152771_aa4e9048faa5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510ht", "b": "8daaf6152771", "c": "aa4e9048faa5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-35-23-45-0-13-43-65281-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788835390, "last_seen": 1788835390, "transport": "t", "ja3_hash": "5e5928045969ccef4ec1fce26f81c134", "ja3_variant_count": 1, "ja3_variants": [ "5e5928045969ccef4ec1fce26f81c134" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510ht_8daaf6152771_ad6271c0f480", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510ht", "b": "8daaf6152771", "c": "ad6271c0f480", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-35-0-11-27-5-16-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788842652, "last_seen": 1788842652, "transport": "t", "ja3_hash": "08484bd58229a185161634ffa42bf1da", "ja3_variant_count": 1, "ja3_variants": [ "08484bd58229a185161634ffa42bf1da" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_07f1a9fa2d24", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "07f1a9fa2d24", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-13-5-11-43-27-65281-0-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789006248, "last_seen": 1789006248, "transport": "t", "ja3_hash": "8492575f30280d6fad895e3f88ddd4f8", "ja3_variant_count": 1, "ja3_variants": [ "8492575f30280d6fad895e3f88ddd4f8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_1e75d25c99ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "1e75d25c99ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-13-65281-0-45-35-11-43-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788962543, "last_seen": 1788962543, "transport": "t", "ja3_hash": "7e5105887edfc262e807dea19e8958d3", "ja3_variant_count": 1, "ja3_variants": [ "7e5105887edfc262e807dea19e8958d3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_22e24e9b3e8f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "22e24e9b3e8f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-17613-0-65037-27-13-45-43-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789651393, "last_seen": 1789651393, "transport": "t", "ja3_hash": "32dbd9d1d69d3b6535fd4c3e24f4f8b8", "ja3_variant_count": 1, "ja3_variants": [ "32dbd9d1d69d3b6535fd4c3e24f4f8b8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_78abf8a7a398", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "78abf8a7a398", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-11-43-13-0-65037-18-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788803634, "last_seen": 1788803634, "transport": "t", "ja3_hash": "1ab82e57977c6e2db27a47400c60b11f", "ja3_variant_count": 1, "ja3_variants": [ "1ab82e57977c6e2db27a47400c60b11f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_7d5c04c6d6fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "7d5c04c6d6fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-5-65281-43-45-0-18-13-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789148320, "last_seen": 1789148320, "transport": "t", "ja3_hash": "7aafab82dc63f83cc4e11ce54bb59b39", "ja3_variant_count": 1, "ja3_variants": [ "7aafab82dc63f83cc4e11ce54bb59b39" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_ed05561cdcbb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "ed05561cdcbb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-43-10-65281-17613-65037-27-0-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789457570, "last_seen": 1789457570, "transport": "t", "ja3_hash": "4c8adbcc6ef6549897c972862b88198e", "ja3_variant_count": 1, "ja3_variants": [ "4c8adbcc6ef6549897c972862b88198e" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_fbe3f329954d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "fbe3f329954d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-0-18-27-35-13-43-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789452930, "last_seen": 1789452930, "transport": "t", "ja3_hash": "1140a63647ff6123b484aa54b2d77c36", "ja3_variant_count": 1, "ja3_variants": [ "1140a63647ff6123b484aa54b2d77c36" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_17fd571d0693", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "17fd571d0693", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-45-10-17613-23-0-13-65281-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788516355, "last_seen": 1788516355, "transport": "t", "ja3_hash": "4948b978019b5221648e0f210d583924", "ja3_variant_count": 1, "ja3_variants": [ "4948b978019b5221648e0f210d583924" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_19841fe9d1e6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "19841fe9d1e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-11-5-13-23-16-65281-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789368930, "last_seen": 1789368930, "transport": "t", "ja3_hash": "67fee289fcd6ffdf911ec7ad0641ce3a", "ja3_variant_count": 1, "ja3_variants": [ "67fee289fcd6ffdf911ec7ad0641ce3a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_1be5d9282827", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "1be5d9282827", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-18-35-0-45-13-16-43-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669085, "last_seen": 1789669085, "transport": "t", "ja3_hash": "0baf074749919722b69f9764c1a2f9a8", "ja3_variant_count": 1, "ja3_variants": [ "0baf074749919722b69f9764c1a2f9a8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_209b8ad6518f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "209b8ad6518f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-16-45-18-23-5-0-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788791281, "last_seen": 1788791281, "transport": "t", "ja3_hash": "4c423957623a41db83004fbb32073e04", "ja3_variant_count": 1, "ja3_variants": [ "4c423957623a41db83004fbb32073e04" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_22875d1bc6f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "22875d1bc6f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-27-45-13-18-65281-5-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027403, "last_seen": 1789027403, "transport": "t", "ja3_hash": "ad6afe08ea53d5756143cec15fc7457e", "ja3_variant_count": 1, "ja3_variants": [ "ad6afe08ea53d5756143cec15fc7457e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_25e3b976f565", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "25e3b976f565", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-65281-11-5-45-17613-16-0-27-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789927624, "last_seen": 1789927624, "transport": "t", "ja3_hash": "4d559ffdae66d07d3a6cc2dcb9b5cc0f", "ja3_variant_count": 1, "ja3_variants": [ "4d559ffdae66d07d3a6cc2dcb9b5cc0f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_2b10ee47c4d4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "2b10ee47c4d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-11-5-18-35-27-13-0-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788993436, "last_seen": 1788993436, "transport": "t", "ja3_hash": "872681f892ca9baa87bd7aa2489aba3d", "ja3_variant_count": 1, "ja3_variants": [ "872681f892ca9baa87bd7aa2489aba3d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_360bbdb5861d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "360bbdb5861d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-11-13-16-23-43-51-65281-45-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 46, "first_seen": 1787804998, "last_seen": 1789571766, "transport": "t", "ja3_hash": "1eb0b3368d6ff19b6eaba2a4f04c2b5f", "ja3_variant_count": 2, "ja3_variants": [ "1eb0b3368d6ff19b6eaba2a4f04c2b5f", "2f8e8303e312fc24db0daa7b43e52d93" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 133, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 522 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_36a8f8f50db5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "36a8f8f50db5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-23-11-65281-10-0-43-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788582127, "last_seen": 1788582127, "transport": "t", "ja3_hash": "6d4cb3453a233ed471ac3e5f82421aec", "ja3_variant_count": 1, "ja3_variants": [ "6d4cb3453a233ed471ac3e5f82421aec" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_3d5dec722ba2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "3d5dec722ba2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-5-43-45-13-27-23-0-16-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789655110, "last_seen": 1789655110, "transport": "t", "ja3_hash": "6174f4c7a8d7fe9aba0cdde3c9afde85", "ja3_variant_count": 1, "ja3_variants": [ "6174f4c7a8d7fe9aba0cdde3c9afde85" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_4213b862c86e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "4213b862c86e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-17613-65037-13-43-11-16-23-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788765053, "last_seen": 1788765053, "transport": "t", "ja3_hash": "c9e016e64c18dc64690e7d57b10ea6ff", "ja3_variant_count": 1, "ja3_variants": [ "c9e016e64c18dc64690e7d57b10ea6ff" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_42223435a986", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "42223435a986", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-65037-0-65281-18-35-16-43-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788802843, "last_seen": 1788802843, "transport": "t", "ja3_hash": "d41d05fcee95d269b6e157ded2ff400b", "ja3_variant_count": 1, "ja3_variants": [ "d41d05fcee95d269b6e157ded2ff400b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_47ffc1ce98ac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "47ffc1ce98ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-13-0-65037-18-43-45-65281-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789858624, "last_seen": 1789858624, "transport": "t", "ja3_hash": "d3f6dc0151906393913d6c6a289afe61", "ja3_variant_count": 1, "ja3_variants": [ "d3f6dc0151906393913d6c6a289afe61" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_4e5585429ba5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "4e5585429ba5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-65037-16-27-43-35-65281-13-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789118341, "last_seen": 1789118341, "transport": "t", "ja3_hash": "9d63b28cd3591b07272d590c7c55a15b", "ja3_variant_count": 1, "ja3_variants": [ "9d63b28cd3591b07272d590c7c55a15b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_5b0fb0c3ff58", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "5b0fb0c3ff58", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-43-11-0-65037-23-51764-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723991, "last_seen": 1788723991, "transport": "t", "ja3_hash": "52caa32b2dccc72603e91d20df321f16", "ja3_variant_count": 1, "ja3_variants": [ "52caa32b2dccc72603e91d20df321f16" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_5b5f5c75cbbe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "5b5f5c75cbbe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-35-17613-43-0-16-45-10-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788731570, "last_seen": 1788731570, "transport": "t", "ja3_hash": "bf0d028b06e68b97d17de84758e59820", "ja3_variant_count": 1, "ja3_variants": [ "bf0d028b06e68b97d17de84758e59820" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_8298423332d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "8298423332d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-0-16-35-13-45-65281-43-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788709823, "last_seen": 1788709823, "transport": "t", "ja3_hash": "41a42cbf761e95e4e153dd126cdfdba0", "ja3_variant_count": 1, "ja3_variants": [ "41a42cbf761e95e4e153dd126cdfdba0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_85a662c2fe29", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "85a662c2fe29", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-23-65281-13-45-27-43-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789843711, "last_seen": 1789843711, "transport": "t", "ja3_hash": "90b933ba4661392126e0ed4cad859a8b", "ja3_variant_count": 1, "ja3_variants": [ "90b933ba4661392126e0ed4cad859a8b" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 10 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_97acd34d019a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "97acd34d019a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-45-0-35-13-17613-65037-16-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789919978, "last_seen": 1789919978, "transport": "t", "ja3_hash": "9ddc4e0082406eb6f008d71f7d6173c3", "ja3_variant_count": 1, "ja3_variants": [ "9ddc4e0082406eb6f008d71f7d6173c3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_c47281b5edb2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "c47281b5edb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-11-16-17613-43-23-27-35-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789326004, "last_seen": 1789326004, "transport": "t", "ja3_hash": "5463183d2b545079d1008ff004564743", "ja3_variant_count": 1, "ja3_variants": [ "5463183d2b545079d1008ff004564743" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_c762e395f2cc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "c762e395f2cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-10-43-0-65037-17613-65281-16-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788730218, "last_seen": 1788730218, "transport": "t", "ja3_hash": "efce995b358f7299ea5fc6609f88f444", "ja3_variant_count": 1, "ja3_variants": [ "efce995b358f7299ea5fc6609f88f444" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_c805d88b9197", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "c805d88b9197", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-35-17613-11-27-5-23-16-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789872687, "last_seen": 1789872687, "transport": "t", "ja3_hash": "af4867692dba49287ee0ee3c96c93a71", "ja3_variant_count": 1, "ja3_variants": [ "af4867692dba49287ee0ee3c96c93a71" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_d09ac63a7c51", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "d09ac63a7c51", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-45-11-43-35-5-18-23-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789829493, "last_seen": 1789829493, "transport": "t", "ja3_hash": "438f75bec9d8f8af8e76122921382d5f", "ja3_variant_count": 1, "ja3_variants": [ "438f75bec9d8f8af8e76122921382d5f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_dfe12e85d0f9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "dfe12e85d0f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-13-27-18-0-17613-45-35-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789671492, "last_seen": 1789671492, "transport": "t", "ja3_hash": "903fbbdba3487aeefbb06f424134ee65", "ja3_variant_count": 1, "ja3_variants": [ "903fbbdba3487aeefbb06f424134ee65" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_ef4a228db532", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "ef4a228db532", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-10-65281-0-5-16-13-23-45-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 20, "first_seen": 1787780329, "last_seen": 1789055458, "transport": "t", "ja3_hash": "91644439ec027e4a30f5cbcb88efae13", "ja3_variant_count": 2, "ja3_variants": [ "91644439ec027e4a30f5cbcb88efae13", "af86da6cc1b8392a61f2c9c3189a3655" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 39, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_f759734d6047", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "f759734d6047", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-18-5-35-43-23-16-65037-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789676701, "last_seen": 1789676701, "transport": "t", "ja3_hash": "7afd8799dbcb10b3d64e223b04f2decc", "ja3_variant_count": 1, "ja3_variants": [ "7afd8799dbcb10b3d64e223b04f2decc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 40 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_f7d53836188e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "f7d53836188e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-13-10-17613-0-11-43-45-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789604468, "last_seen": 1789604468, "transport": "t", "ja3_hash": "d3f8eb2648141e424c0115c452bcaf37", "ja3_variant_count": 1, "ja3_variants": [ "d3f8eb2648141e424c0115c452bcaf37" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_fc94c450c1d6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "fc94c450c1d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-13-17613-45-27-5-16-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788964090, "last_seen": 1788964090, "transport": "t", "ja3_hash": "e7c2b1f0978cedbf2691d8c50e718f11", "ja3_variant_count": 1, "ja3_variants": [ "e7c2b1f0978cedbf2691d8c50e718f11" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1511ht_8daaf6152771_1a9dea147c97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511ht", "b": "8daaf6152771", "c": "1a9dea147c97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-18-5-27-43-16-35-0-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789882317, "last_seen": 1789882317, "transport": "t", "ja3_hash": "0fc172f91f4b993ef3c4223d57addea8", "ja3_variant_count": 1, "ja3_variants": [ "0fc172f91f4b993ef3c4223d57addea8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511ht_8daaf6152771_3314efd28c0b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511ht", "b": "8daaf6152771", "c": "3314efd28c0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-10-11-13-16-5-65037-43-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789453018, "last_seen": 1789453018, "transport": "t", "ja3_hash": "14a3376ef957ae0b45e5d554c2b82dcb", "ja3_variant_count": 1, "ja3_variants": [ "14a3376ef957ae0b45e5d554c2b82dcb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511ht_8daaf6152771_3ebb54a1387c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511ht", "b": "8daaf6152771", "c": "3ebb54a1387c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-0-65281-45-35-18-16-65037-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788481192, "last_seen": 1788481192, "transport": "t", "ja3_hash": "f84c52c8a04320a66ed3a4138d7ca5c2", "ja3_variant_count": 1, "ja3_variants": [ "f84c52c8a04320a66ed3a4138d7ca5c2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511ht_8daaf6152771_4272f35cc6ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511ht", "b": "8daaf6152771", "c": "4272f35cc6ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-13-35-43-65037-10-0-65281-5-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788841208, "last_seen": 1788841208, "transport": "t", "ja3_hash": "a95523af5f5491f456b323c96fc5a2ea", "ja3_variant_count": 1, "ja3_variants": [ "a95523af5f5491f456b323c96fc5a2ea" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511ht_8daaf6152771_757c955fe60b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511ht", "b": "8daaf6152771", "c": "757c955fe60b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49196-52393-49199-49200-49171-49172-52392-156-157-47-53,0-23-65281-10-11-35-16-13-51-45-43,4588-25497-29-65074-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 65074, "name": "65074 (0xfe32)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788379490, "last_seen": 1789548050, "transport": "t", "ja3_hash": "6c86e352b6818bacf1b5f5b06aa262d8", "ja3_variant_count": 1, "ja3_variants": [ "6c86e352b6818bacf1b5f5b06aa262d8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (compatible; ChannelResearchBot/1.0; +contact via CSV owner)": 6 }, "ua_disagreement": false } }, { "hash": "t13d1511ht_8daaf6152771_7d2a48118bed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511ht", "b": "8daaf6152771", "c": "7d2a48118bed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-43-0-16-27-65037-35-18-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789637007, "last_seen": 1789637007, "transport": "t", "ja3_hash": "b8ff270f07fa551e0d35e51d20bf44cc", "ja3_variant_count": 1, "ja3_variants": [ "b8ff270f07fa551e0d35e51d20bf44cc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511ht_8daaf6152771_7e1e4ea41477", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511ht", "b": "8daaf6152771", "c": "7e1e4ea41477", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-10-65281-35-27-0-65037-43-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789625713, "last_seen": 1789625713, "transport": "t", "ja3_hash": "acec3da8c1a750d81145d9ff8dc5da18", "ja3_variant_count": 1, "ja3_variants": [ "acec3da8c1a750d81145d9ff8dc5da18" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511ht_8daaf6152771_be5c9291e5cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511ht", "b": "8daaf6152771", "c": "be5c9291e5cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-43-11-35-13-27-45-16-0-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789149013, "last_seen": 1789149013, "transport": "t", "ja3_hash": "898845b2d2358c71172136dddac0c2e1", "ja3_variant_count": 1, "ja3_variants": [ "898845b2d2358c71172136dddac0c2e1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_0b5fc2fc3b07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "0b5fc2fc3b07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-65281-5-35-13-65037-45-10-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788835506, "last_seen": 1788835506, "transport": "t", "ja3_hash": "6b4d0df56d37ddcb6050163dc8031cfd", "ja3_variant_count": 1, "ja3_variants": [ "6b4d0df56d37ddcb6050163dc8031cfd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_1e3282a30c40", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "1e3282a30c40", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-10-18-65281-0-11-43-35-27-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789740906, "last_seen": 1789740906, "transport": "t", "ja3_hash": "1225664cf95d46122aa6170e9bfb29e8", "ja3_variant_count": 1, "ja3_variants": [ "1225664cf95d46122aa6170e9bfb29e8" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 2 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_1f5872d1fd3f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "1f5872d1fd3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-0-43-18-45-13-11-17613-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788763295, "last_seen": 1788763295, "transport": "t", "ja3_hash": "17d2b5280a354fcb8707c4fe789b4aaa", "ja3_variant_count": 1, "ja3_variants": [ "17d2b5280a354fcb8707c4fe789b4aaa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_31938250cbb9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "31938250cbb9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-18-0-5-45-23-65281-13-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789883305, "last_seen": 1789883305, "transport": "t", "ja3_hash": "f2be5ee55a118617ee1ffabe6075f5f1", "ja3_variant_count": 1, "ja3_variants": [ "f2be5ee55a118617ee1ffabe6075f5f1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_3e16e91cc5f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "3e16e91cc5f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-5-0-13-18-45-11-65037-43-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788956535, "last_seen": 1788956535, "transport": "t", "ja3_hash": "04b957cea200d9ca77f9710faec0f3e1", "ja3_variant_count": 1, "ja3_variants": [ "04b957cea200d9ca77f9710faec0f3e1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_4aea63be1d8f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "4aea63be1d8f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-27-43-5-18-17613-23-0-13-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788855378, "last_seen": 1788855378, "transport": "t", "ja3_hash": "11006a684c1944308f051b1eea5c43e7", "ja3_variant_count": 1, "ja3_variants": [ "11006a684c1944308f051b1eea5c43e7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 20 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_5b71f8e78adb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "5b71f8e78adb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-23-35-65037-11-5-45-17613-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788565040, "last_seen": 1788565040, "transport": "t", "ja3_hash": "670d81d6eadda63fe53b668a35f11d54", "ja3_variant_count": 1, "ja3_variants": [ "670d81d6eadda63fe53b668a35f11d54" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_644078a2e2f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "644078a2e2f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-65037-11-43-10-5-18-17613-0-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789704537, "last_seen": 1789704537, "transport": "t", "ja3_hash": "f01b0541af2b07833d7d094f13fa89f3", "ja3_variant_count": 1, "ja3_variants": [ "f01b0541af2b07833d7d094f13fa89f3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_6b09fc79ad32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "6b09fc79ad32", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-13-35-65037-51764-45-27-11-43-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789669046, "last_seen": 1789669046, "transport": "t", "ja3_hash": "55392fd03e5feb7b511274b45e02cf3c", "ja3_variant_count": 1, "ja3_variants": [ "55392fd03e5feb7b511274b45e02cf3c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_850d0a6af0b4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "850d0a6af0b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-18-10-17613-65281-27-43-0-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789035462, "last_seen": 1789035462, "transport": "t", "ja3_hash": "e70ab9b5dcf6436f6941a5afadc0d58e", "ja3_variant_count": 1, "ja3_variants": [ "e70ab9b5dcf6436f6941a5afadc0d58e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_9f720e18b5ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "9f720e18b5ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-18-43-35-27-23-0-45-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789306868, "last_seen": 1789306868, "transport": "t", "ja3_hash": "800e5228b5c08c52eb6df504c8ea72cb", "ja3_variant_count": 1, "ja3_variants": [ "800e5228b5c08c52eb6df504c8ea72cb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_eb301d6ffdc9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "eb301d6ffdc9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-23-43-5-0-65281-35-10-27-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789627308, "last_seen": 1789627308, "transport": "t", "ja3_hash": "b73b702868174a280adcf4bd0db5b0ac", "ja3_variant_count": 1, "ja3_variants": [ "b73b702868174a280adcf4bd0db5b0ac" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_f577fa8935a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "f577fa8935a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-23-0-65281-13-5-35-45-10-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789853897, "last_seen": 1789853897, "transport": "t", "ja3_hash": "7d5b6ee65eb6d606dbe3aba9f02bbc15", "ja3_variant_count": 1, "ja3_variants": [ "7d5b6ee65eb6d606dbe3aba9f02bbc15" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 29 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_0164fa580d60", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "0164fa580d60", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-13-23-18-16-10-43-17513-0-35-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788609808, "last_seen": 1788609808, "transport": "t", "ja3_hash": "5662e51d509364dde73dca969d0b8451", "ja3_variant_count": 1, "ja3_variants": [ "5662e51d509364dde73dca969d0b8451" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_04e2e80bd37f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "04e2e80bd37f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-43-23-5-0-10-35-11-65281-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789682736, "last_seen": 1789682736, "transport": "t", "ja3_hash": "e10344affe5c47cc1fa5bb7632a01073", "ja3_variant_count": 1, "ja3_variants": [ "e10344affe5c47cc1fa5bb7632a01073" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_090f2b624444", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "090f2b624444", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-18-35-23-13-65037-27-45-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789028633, "last_seen": 1789028633, "transport": "t", "ja3_hash": "db89e742a809e003a06c95bc8452c64e", "ja3_variant_count": 1, "ja3_variants": [ "db89e742a809e003a06c95bc8452c64e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_0ecc311eab21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "0ecc311eab21", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-27-45-43-10-16-5-65037-23-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789009663, "last_seen": 1789009663, "transport": "t", "ja3_hash": "75372f74f3f19af5039d085fdd0527b9", "ja3_variant_count": 1, "ja3_variants": [ "75372f74f3f19af5039d085fdd0527b9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_1a64300c5a06", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "1a64300c5a06", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-0-11-10-23-43-18-17613-35-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789346527, "last_seen": 1789346527, "transport": "t", "ja3_hash": "40579b6b14aad156b15b4c3caedc665d", "ja3_variant_count": 1, "ja3_variants": [ "40579b6b14aad156b15b4c3caedc665d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_2f4e7de0857d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "2f4e7de0857d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-17613-16-35-51764-23-11-0-13-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788459300, "last_seen": 1788459300, "transport": "t", "ja3_hash": "c36200a8b9419864aa64d576f94a1630", "ja3_variant_count": 1, "ja3_variants": [ "c36200a8b9419864aa64d576f94a1630" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_30ccf3c97a91", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "30ccf3c97a91", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-11-18-10-35-17613-43-65281-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789240086, "last_seen": 1789240086, "transport": "t", "ja3_hash": "4a7a6b540b6dffc7b8f09482a7a8f757", "ja3_variant_count": 1, "ja3_variants": [ "4a7a6b540b6dffc7b8f09482a7a8f757" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_4117c4a90569", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "4117c4a90569", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-65037-0-5-10-18-17613-27-16-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789680538, "last_seen": 1789680538, "transport": "t", "ja3_hash": "b2e5a1d70b39e07de4278397b831de35", "ja3_variant_count": 1, "ja3_variants": [ "b2e5a1d70b39e07de4278397b831de35" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_470abf78f606", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "470abf78f606", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-23-65281-5-43-16-13-10-0-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788803580, "last_seen": 1788803580, "transport": "t", "ja3_hash": "e258164c3235eaae51481ca9be09de38", "ja3_variant_count": 1, "ja3_variants": [ "e258164c3235eaae51481ca9be09de38" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_479def3d05ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "479def3d05ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-35-13-23-10-11-5-0-16-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789950618, "last_seen": 1789950618, "transport": "t", "ja3_hash": "bba2dae0fad0a764f273b6cfbcfc5c72", "ja3_variant_count": 1, "ja3_variants": [ "bba2dae0fad0a764f273b6cfbcfc5c72" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_498c980218f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "498c980218f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-65281-17613-65037-43-16-0-45-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789460148, "last_seen": 1789460148, "transport": "t", "ja3_hash": "47deee615069d42b93b9e547f4346829", "ja3_variant_count": 1, "ja3_variants": [ "47deee615069d42b93b9e547f4346829" ], "user_agents": { "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)": 1, "Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)": 3, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0": 36 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_4e87461a2012", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "4e87461a2012", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-11-13-17613-45-27-43-16-0-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789684758, "last_seen": 1789684758, "transport": "t", "ja3_hash": "989f3b10a348d73702ee4c63fc879b03", "ja3_variant_count": 1, "ja3_variants": [ "989f3b10a348d73702ee4c63fc879b03" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_5284d20f7339", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "5284d20f7339", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-43-35-18-11-16-17613-27-65281-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788613701, "last_seen": 1788613701, "transport": "t", "ja3_hash": "08ca361b722e7a42a161868e9e9f4d35", "ja3_variant_count": 1, "ja3_variants": [ "08ca361b722e7a42a161868e9e9f4d35" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_5f71f9687479", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "5f71f9687479", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-5-0-10-16-65281-11-13-43-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789553272, "last_seen": 1789553272, "transport": "t", "ja3_hash": "6fdc589441d112de93b961f9783c9278", "ja3_variant_count": 1, "ja3_variants": [ "6fdc589441d112de93b961f9783c9278" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_745d60ce57c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "745d60ce57c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-10-18-43-16-45-27-17613-5-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788813124, "last_seen": 1788813124, "transport": "t", "ja3_hash": "8c7dd42d36936b608312ce854eff25ab", "ja3_variant_count": 1, "ja3_variants": [ "8c7dd42d36936b608312ce854eff25ab" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_7bb9ecec12a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "7bb9ecec12a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-65281-45-43-18-16-11-27-35-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788799956, "last_seen": 1788799956, "transport": "t", "ja3_hash": "ec8a8fa7eca883d2736b36cc7614f8f1", "ja3_variant_count": 1, "ja3_variants": [ "ec8a8fa7eca883d2736b36cc7614f8f1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_9110f32f0a82", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "9110f32f0a82", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-27-43-23-17613-11-18-45-16-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788765323, "last_seen": 1788765323, "transport": "t", "ja3_hash": "89391ca6f49100f2265703bc0e6ce3d9", "ja3_variant_count": 1, "ja3_variants": [ "89391ca6f49100f2265703bc0e6ce3d9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_9de5a55bffef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "9de5a55bffef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-43-65037-10-5-13-11-45-27-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788900221, "last_seen": 1788900221, "transport": "t", "ja3_hash": "97e8f511fc14aafa1054bcbda862f1f1", "ja3_variant_count": 1, "ja3_variants": [ "97e8f511fc14aafa1054bcbda862f1f1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 23 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_ad60ef693faa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "ad60ef693faa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-45-35-18-5-27-43-65281-23-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789759380, "last_seen": 1789759380, "transport": "t", "ja3_hash": "71f38aeff2f40adf58bc493e7331ae91", "ja3_variant_count": 1, "ja3_variants": [ "71f38aeff2f40adf58bc493e7331ae91" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_c80afcb9d01f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "c80afcb9d01f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-16-13-11-10-0-43-17613-18-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789686309, "last_seen": 1789686309, "transport": "t", "ja3_hash": "b03e5bdb3e62bfb13e43b0fd57fac9bb", "ja3_variant_count": 1, "ja3_variants": [ "b03e5bdb3e62bfb13e43b0fd57fac9bb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_c8d9e32dfc3f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "c8d9e32dfc3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-0-23-27-17613-43-11-35-16-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788778647, "last_seen": 1788778647, "transport": "t", "ja3_hash": "b27dfaba2aa05de39198a5f4c24a58c2", "ja3_variant_count": 1, "ja3_variants": [ "b27dfaba2aa05de39198a5f4c24a58c2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_c94d08fa97eb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "c94d08fa97eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-16-23-65281-5-11-0-18-43-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788778336, "last_seen": 1788778336, "transport": "t", "ja3_hash": "ed64910369fc22f878ebadc05b0c0c0f", "ja3_variant_count": 1, "ja3_variants": [ "ed64910369fc22f878ebadc05b0c0c0f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_d53a3f86ebec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "d53a3f86ebec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-16-11-18-5-17613-65037-23-0-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789018177, "last_seen": 1789018177, "transport": "t", "ja3_hash": "8be44019d0cf060ef514ba8b4d2292a7", "ja3_variant_count": 1, "ja3_variants": [ "8be44019d0cf060ef514ba8b4d2292a7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_d786283522ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "d786283522ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-11-10-35-5-16-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787454864, "last_seen": 1789853900, "transport": "t", "ja3_hash": "bf57dec2e7a00870764f29e4d2e5a521", "ja3_variant_count": 1, "ja3_variants": [ "bf57dec2e7a00870764f29e4d2e5a521" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 50, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 101 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_df33fa9fde1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "df33fa9fde1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-11-0-35-10-43-13-16-18-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789663253, "last_seen": 1789663253, "transport": "t", "ja3_hash": "37efaed3db5de2a8b00cdd2dfd33a308", "ja3_variant_count": 1, "ja3_variants": [ "37efaed3db5de2a8b00cdd2dfd33a308" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_e914590bca29", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "e914590bca29", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-65037-65281-5-43-45-35-10-0-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789326021, "last_seen": 1789326021, "transport": "t", "ja3_hash": "831277ba014daf3e618f69b3ca214ed1", "ja3_variant_count": 1, "ja3_variants": [ "831277ba014daf3e618f69b3ca214ed1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_eb8e8aae6a2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "eb8e8aae6a2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-16-13-5-35-45-27-10-23-18-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789657908, "last_seen": 1789657908, "transport": "t", "ja3_hash": "5c0aa93feeed11f4580124d67385808b", "ja3_variant_count": 1, "ja3_variants": [ "5c0aa93feeed11f4580124d67385808b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 17 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f2ac47f4899b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f2ac47f4899b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-27-35-16-0-65281-45-11-17613-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788617389, "last_seen": 1789026661, "transport": "t", "ja3_hash": "e952db13f5c79b8d8667ed684e1a2b04", "ja3_variant_count": 2, "ja3_variants": [ "e952db13f5c79b8d8667ed684e1a2b04", "0b70cef999a083031b95ed9092bbf3a9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f5ed932adb5b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f5ed932adb5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-16-45-13-18-35-17613-0-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788704456, "last_seen": 1788704456, "transport": "t", "ja3_hash": "f0c8de8254e6492f942736e5ab2dc420", "ja3_variant_count": 1, "ja3_variants": [ "f0c8de8254e6492f942736e5ab2dc420" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f60d493e73b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f60d493e73b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-18-17613-65281-5-13-10-23-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788974439, "last_seen": 1788974439, "transport": "t", "ja3_hash": "e477832203c86afd6e19607233bc7dff", "ja3_variant_count": 1, "ja3_variants": [ "e477832203c86afd6e19607233bc7dff" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_fd9bfc4d791b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "fd9bfc4d791b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-23-13-17613-0-43-35-65037-16-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789170591, "last_seen": 1789170591, "transport": "t", "ja3_hash": "765113a258ef48d76a5acbfdc37d9a6a", "ja3_variant_count": 1, "ja3_variants": [ "765113a258ef48d76a5acbfdc37d9a6a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1512ht_8daaf6152771_2e5d2470a667", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512ht", "b": "8daaf6152771", "c": "2e5d2470a667", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-11-18-16-35-45-0-27-65037-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789631585, "last_seen": 1789631585, "transport": "t", "ja3_hash": "e693895cc51dc9e065cbdf5071ea7907", "ja3_variant_count": 1, "ja3_variants": [ "e693895cc51dc9e065cbdf5071ea7907" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512ht_8daaf6152771_3fc4a4ba746a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512ht", "b": "8daaf6152771", "c": "3fc4a4ba746a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-13-35-27-5-65037-0-18-43-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788823768, "last_seen": 1788823768, "transport": "t", "ja3_hash": "80892bf90e735d07f9d32ade869d44a4", "ja3_variant_count": 1, "ja3_variants": [ "80892bf90e735d07f9d32ade869d44a4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512ht_8daaf6152771_5f71f9687479", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512ht", "b": "8daaf6152771", "c": "5f71f9687479", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-0-43-5-65281-16-65037-11-10-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789878643, "last_seen": 1789878643, "transport": "t", "ja3_hash": "02f5e8187a420d135348ba9809e508b2", "ja3_variant_count": 1, "ja3_variants": [ "02f5e8187a420d135348ba9809e508b2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512ht_8daaf6152771_8a094a45964e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512ht", "b": "8daaf6152771", "c": "8a094a45964e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-45-43-27-5-0-11-10-23-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788881433, "last_seen": 1788881433, "transport": "t", "ja3_hash": "a01244e61f25e625c363f3429598d7ea", "ja3_variant_count": 1, "ja3_variants": [ "a01244e61f25e625c363f3429598d7ea" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512ht_8daaf6152771_8a15aa23c6a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512ht", "b": "8daaf6152771", "c": "8a15aa23c6a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-0-35-65037-10-45-27-43-16-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788888860, "last_seen": 1788888860, "transport": "t", "ja3_hash": "b1c02e3d98badcc94e013130e81d7c46", "ja3_variant_count": 1, "ja3_variants": [ "b1c02e3d98badcc94e013130e81d7c46" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512ht_8daaf6152771_bc5e3f5584ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512ht", "b": "8daaf6152771", "c": "bc5e3f5584ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-11-23-16-18-43-5-45-0-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789455704, "last_seen": 1789455704, "transport": "t", "ja3_hash": "a20cd241ccec8895f409353824ae815e", "ja3_variant_count": 1, "ja3_variants": [ "a20cd241ccec8895f409353824ae815e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512ht_8daaf6152771_cbf5d407ad44", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512ht", "b": "8daaf6152771", "c": "cbf5d407ad44", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-43-23-45-27-65037-13-16-0-65281-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788880979, "last_seen": 1788880979, "transport": "t", "ja3_hash": "a66f5f976c3923df00fd7fa57ec2ce4e", "ja3_variant_count": 1, "ja3_variants": [ "a66f5f976c3923df00fd7fa57ec2ce4e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512ht_8daaf6152771_cda627cc036f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512ht", "b": "8daaf6152771", "c": "cda627cc036f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-23-0-45-16-11-10-43-65281-27-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789629208, "last_seen": 1789629208, "transport": "t", "ja3_hash": "e3ee0e5584e62afe6eca130b4a5cdab0", "ja3_variant_count": 1, "ja3_variants": [ "e3ee0e5584e62afe6eca130b4a5cdab0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512ht_8daaf6152771_db6f5dd1db73", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512ht", "b": "8daaf6152771", "c": "db6f5dd1db73", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-11-18-43-0-10-27-5-13-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789882731, "last_seen": 1789882731, "transport": "t", "ja3_hash": "b5dc919ed161e64fa9debbabb7a98ea4", "ja3_variant_count": 1, "ja3_variants": [ "b5dc919ed161e64fa9debbabb7a98ea4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512ht_8daaf6152771_f2cf0661a204", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512ht", "b": "8daaf6152771", "c": "f2cf0661a204", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-18-16-23-11-13-45-43-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789830987, "last_seen": 1789830987, "transport": "t", "ja3_hash": "a648ec518f0a43df0c95bdd37b995b07", "ja3_variant_count": 1, "ja3_variants": [ "a648ec518f0a43df0c95bdd37b995b07" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_268af3b1fe2b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "268af3b1fe2b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-35-65037-10-17613-45-13-43-23-18-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788670834, "last_seen": 1788670834, "transport": "t", "ja3_hash": "28982f234eadf90df3d8594a20538432", "ja3_variant_count": 1, "ja3_variants": [ "28982f234eadf90df3d8594a20538432" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 13 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_2cf96e366668", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "2cf96e366668", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-65281-5-18-13-35-17613-10-27-43-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788568578, "last_seen": 1788568578, "transport": "t", "ja3_hash": "2210a55d8f29476fa237e741a5bc977b", "ja3_variant_count": 1, "ja3_variants": [ "2210a55d8f29476fa237e741a5bc977b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_34349be5a8b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "34349be5a8b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-5-65037-23-35-17613-45-43-11-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789048553, "last_seen": 1789048553, "transport": "t", "ja3_hash": "b161bd180922712cd7f3503193ba3b75", "ja3_variant_count": 1, "ja3_variants": [ "b161bd180922712cd7f3503193ba3b75" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_47357f42791c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "47357f42791c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-17613-23-65281-11-18-10-27-43-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788793307, "last_seen": 1788793307, "transport": "t", "ja3_hash": "95b03b1a11aa6c639a484f0a6c6c53b4", "ja3_variant_count": 1, "ja3_variants": [ "95b03b1a11aa6c639a484f0a6c6c53b4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_4a2875325200", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "4a2875325200", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-17613-0-45-65037-18-23-35-11-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789687313, "last_seen": 1789687313, "transport": "t", "ja3_hash": "0703401c3416791fa76ced96da2ad19b", "ja3_variant_count": 1, "ja3_variants": [ "0703401c3416791fa76ced96da2ad19b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_4bd7c67ac9cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "4bd7c67ac9cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-4832-10-18-5-17613-11-43-23-13-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788713056, "last_seen": 1788713056, "transport": "t", "ja3_hash": "53fddee5a5234fc8e97be0dfff9f9d56", "ja3_variant_count": 1, "ja3_variants": [ "53fddee5a5234fc8e97be0dfff9f9d56" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_605a68f2a083", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "605a68f2a083", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-23-27-65281-11-0-10-65037-35-5-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789879478, "last_seen": 1789879478, "transport": "t", "ja3_hash": "20ec1bac9a4cdcfeb80c82dc73117b56", "ja3_variant_count": 1, "ja3_variants": [ "20ec1bac9a4cdcfeb80c82dc73117b56" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_7c1cb1840f01", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "7c1cb1840f01", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-13-65037-0-18-10-43-5-27-23-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788843320, "last_seen": 1788843320, "transport": "t", "ja3_hash": "5f63e55a15890df6cca972097e504648", "ja3_variant_count": 1, "ja3_variants": [ "5f63e55a15890df6cca972097e504648" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_7f5d6971f013", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "7f5d6971f013", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-65037-11-35-45-27-13-18-0-65281-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789912223, "last_seen": 1789912223, "transport": "t", "ja3_hash": "34445555d43ce81c71659feca331e1f6", "ja3_variant_count": 1, "ja3_variants": [ "34445555d43ce81c71659feca331e1f6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 7 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_93dea2ee8131", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "93dea2ee8131", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-13-0-17613-35-43-51764-10-18-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789641940, "last_seen": 1789641940, "transport": "t", "ja3_hash": "56257a2960979e47eca674879ddeda06", "ja3_variant_count": 1, "ja3_variants": [ "56257a2960979e47eca674879ddeda06" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_b5d0d3665e38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "b5d0d3665e38", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-23-13-65281-43-35-45-0-5-17613-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788634754, "last_seen": 1788634754, "transport": "t", "ja3_hash": "8cc39438316bacb2adf38edb7aea1eff", "ja3_variant_count": 1, "ja3_variants": [ "8cc39438316bacb2adf38edb7aea1eff" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_b98e6d6adde4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "b98e6d6adde4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-45-13-65037-0-23-65281-43-35-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788874038, "last_seen": 1788874038, "transport": "t", "ja3_hash": "abc3061e737ee63f6ff8a4994455d1a0", "ja3_variant_count": 1, "ja3_variants": [ "abc3061e737ee63f6ff8a4994455d1a0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_b9ad58eb41fb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "b9ad58eb41fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-45-17613-11-65037-43-35-13-65281-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789043623, "last_seen": 1789043623, "transport": "t", "ja3_hash": "90c82a2ed7c0f530d5396d7be1e10378", "ja3_variant_count": 1, "ja3_variants": [ "90c82a2ed7c0f530d5396d7be1e10378" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_bbb3b3c18aa5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "bbb3b3c18aa5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-65281-23-11-10-43-13-65037-27-35-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788691437, "last_seen": 1788691437, "transport": "t", "ja3_hash": "43800a79306eb6933860e3410a163516", "ja3_variant_count": 1, "ja3_variants": [ "43800a79306eb6933860e3410a163516" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 9 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_c4dc4e121602", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "c4dc4e121602", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-13-5-27-65281-17613-10-43-35-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788916164, "last_seen": 1788916164, "transport": "t", "ja3_hash": "c2581cacdde6301913cc78f2760fa31a", "ja3_variant_count": 1, "ja3_variants": [ "c2581cacdde6301913cc78f2760fa31a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_c67bf4e3931d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "c67bf4e3931d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-65037-13-0-27-45-43-18-11-23-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788884564, "last_seen": 1788884564, "transport": "t", "ja3_hash": "073d547148bfbf761fa9dfed1c2d2dd1", "ja3_variant_count": 1, "ja3_variants": [ "073d547148bfbf761fa9dfed1c2d2dd1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_c8d981156ff5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "c8d981156ff5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-35-0-13-65281-45-43-18-27-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788798881, "last_seen": 1788798881, "transport": "t", "ja3_hash": "ae2f997f6f76374c9e6ab62fdabf8658", "ja3_variant_count": 1, "ja3_variants": [ "ae2f997f6f76374c9e6ab62fdabf8658" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_caf8bae1a533", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "caf8bae1a533", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-23-10-65281-18-43-11-65037-27-5-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789703474, "last_seen": 1789703474, "transport": "t", "ja3_hash": "f8ae62c38bd7442b64ddae16afadeb75", "ja3_variant_count": 1, "ja3_variants": [ "f8ae62c38bd7442b64ddae16afadeb75" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_cfe4dda37004", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "cfe4dda37004", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-45-17613-0-13-65037-18-5-65281-35-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789829938, "last_seen": 1789829938, "transport": "t", "ja3_hash": "be1b66938efc3d835fee85389bbaf6d2", "ja3_variant_count": 1, "ja3_variants": [ "be1b66938efc3d835fee85389bbaf6d2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_d4e331375a5e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "d4e331375a5e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-35-5-65037-45-0-27-11-13-65281-10-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789883794, "last_seen": 1789883794, "transport": "t", "ja3_hash": "06730deb66235433f4fdde0613e5654a", "ja3_variant_count": 1, "ja3_variants": [ "06730deb66235433f4fdde0613e5654a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_e5a3b5057b72", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "e5a3b5057b72", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-43-65281-45-27-0-10-11-17613-18-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788678209, "last_seen": 1788678209, "transport": "t", "ja3_hash": "935d77af5505ca5a7f97207a56f69a8a", "ja3_variant_count": 1, "ja3_variants": [ "935d77af5505ca5a7f97207a56f69a8a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_e7b1aae15fe9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "e7b1aae15fe9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-13-0-43-65037-17613-11-23-35-18-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788659507, "last_seen": 1789697907, "transport": "t", "ja3_hash": "0384d5abf9616335204fec7fe7dace7d", "ja3_variant_count": 2, "ja3_variants": [ "0384d5abf9616335204fec7fe7dace7d", "b59093a1db481443944a1e52cb8b7179" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_fddca07d18b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "fddca07d18b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-5-11-27-43-0-35-17613-13-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788527147, "last_seen": 1788527147, "transport": "t", "ja3_hash": "3cc9a413870e23bd88fc6a86c553ea13", "ja3_variant_count": 1, "ja3_variants": [ "3cc9a413870e23bd88fc6a86c553ea13" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_05750f4ee4a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "05750f4ee4a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-16-45-18-43-23-65037-0-35-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788860941, "last_seen": 1788860941, "transport": "t", "ja3_hash": "50a260e1f4d448a893fe2fe28164835d", "ja3_variant_count": 1, "ja3_variants": [ "50a260e1f4d448a893fe2fe28164835d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_16ac493eba88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "16ac493eba88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-5-17613-35-65037-0-13-10-43-16-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789022142, "last_seen": 1789022142, "transport": "t", "ja3_hash": "38d5731a4e5549c59e86dfdf0cbf7dd4", "ja3_variant_count": 1, "ja3_variants": [ "38d5731a4e5549c59e86dfdf0cbf7dd4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_26659bca45b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "26659bca45b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-11-17613-0-43-5-45-13-23-10-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788825494, "last_seen": 1788825494, "transport": "t", "ja3_hash": "377222bd03110a759c18283c8d5e7f9e", "ja3_variant_count": 1, "ja3_variants": [ "377222bd03110a759c18283c8d5e7f9e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_292b84349f7b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "292b84349f7b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-65281-27-23-43-35-10-5-0-65037-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789937406, "last_seen": 1789937406, "transport": "t", "ja3_hash": "0c0ed1bd83a5c438fa2ad8663df14ab5", "ja3_variant_count": 1, "ja3_variants": [ "0c0ed1bd83a5c438fa2ad8663df14ab5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_2decd6c1bed5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "2decd6c1bed5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-35-43-0-11-65281-10-27-65037-16-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789667825, "last_seen": 1789667825, "transport": "t", "ja3_hash": "38deea31b1c4930853d3941b39e5db4c", "ja3_variant_count": 1, "ja3_variants": [ "38deea31b1c4930853d3941b39e5db4c" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_30b0ae8403c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "30b0ae8403c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-5-16-51764-18-17613-43-0-13-27-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789644310, "last_seen": 1789644310, "transport": "t", "ja3_hash": "1ef1cc0863438eb885f414257a35962e", "ja3_variant_count": 1, "ja3_variants": [ "1ef1cc0863438eb885f414257a35962e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_319e1b2448d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "319e1b2448d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-16-65037-35-10-65281-27-45-18-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788772024, "last_seen": 1788772024, "transport": "t", "ja3_hash": "7c786f27a6992cef3e3c18ed1f5bf579", "ja3_variant_count": 1, "ja3_variants": [ "7c786f27a6992cef3e3c18ed1f5bf579" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_31cfec764849", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "31cfec764849", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-43-0-5-16-27-18-35-65281-23-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788807486, "last_seen": 1788807486, "transport": "t", "ja3_hash": "734e818a56bdc29607bf993b3c5eadae", "ja3_variant_count": 1, "ja3_variants": [ "734e818a56bdc29607bf993b3c5eadae" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_36e266dff31d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "36e266dff31d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-43-45-18-65281-10-0-27-17613-16-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788832296, "last_seen": 1788832296, "transport": "t", "ja3_hash": "5094e81ad7e0b99ce791ac66b698cce2", "ja3_variant_count": 1, "ja3_variants": [ "5094e81ad7e0b99ce791ac66b698cce2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_371bb53416dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "371bb53416dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-27-45-16-43-13-11-65281-35-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789451328, "last_seen": 1789451328, "transport": "t", "ja3_hash": "60ebf3a2d67833e1ee39383c439dfd3e", "ja3_variant_count": 1, "ja3_variants": [ "60ebf3a2d67833e1ee39383c439dfd3e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 51 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_37352656bd0e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "37352656bd0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-35-13-43-45-11-0-65037-16-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788776649, "last_seen": 1788776649, "transport": "t", "ja3_hash": "99d67dc46fb1eb52e0677bb422a68966", "ja3_variant_count": 1, "ja3_variants": [ "99d67dc46fb1eb52e0677bb422a68966" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_41ae67c3855e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "41ae67c3855e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-27-16-65037-11-18-13-10-43-0-45-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788621943, "last_seen": 1788621943, "transport": "t", "ja3_hash": "95a7bc3d41ce203ef50efd1d0609e0fe", "ja3_variant_count": 1, "ja3_variants": [ "95a7bc3d41ce203ef50efd1d0609e0fe" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 16 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_4c427b262de3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "4c427b262de3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-35-17613-27-5-65037-13-16-43-10-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789756210, "last_seen": 1789756210, "transport": "t", "ja3_hash": "8073ac34ff3ab0deea3aec31420894ef", "ja3_variant_count": 1, "ja3_variants": [ "8073ac34ff3ab0deea3aec31420894ef" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_508a64778336", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "508a64778336", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-11-0-43-13-27-17613-23-45-65281-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789169065, "last_seen": 1789169065, "transport": "t", "ja3_hash": "fe6a6057a6ce3d8d77837d0e1466545e", "ja3_variant_count": 1, "ja3_variants": [ "fe6a6057a6ce3d8d77837d0e1466545e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_50aa0eca22b4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "50aa0eca22b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-0-43-65037-45-5-35-16-11-13-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788829199, "last_seen": 1788829199, "transport": "t", "ja3_hash": "5fbf8ca39f2e135289a7b868bbda5f72", "ja3_variant_count": 1, "ja3_variants": [ "5fbf8ca39f2e135289a7b868bbda5f72" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_514943fa2261", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "514943fa2261", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788988735, "last_seen": 1788988735, "transport": "t", "ja3_hash": "0faf2a91198d40dbd58b9308f3fca2fd", "ja3_variant_count": 1, "ja3_variants": [ "0faf2a91198d40dbd58b9308f3fca2fd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_632aef45f8fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "632aef45f8fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-65281-13-43-11-45-27-65037-23-35-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789733000, "last_seen": 1789733000, "transport": "t", "ja3_hash": "5a4242cc82cd7de608a014ad80bc3a43", "ja3_variant_count": 1, "ja3_variants": [ "5a4242cc82cd7de608a014ad80bc3a43" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 25 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_68e16b2411fc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "68e16b2411fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-0-17613-43-27-10-5-65281-13-35-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789197841, "last_seen": 1789197841, "transport": "t", "ja3_hash": "90e769aee86b15c61dfc81a8aaa1e922", "ja3_variant_count": 1, "ja3_variants": [ "90e769aee86b15c61dfc81a8aaa1e922" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_6da051328960", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "6da051328960", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-52393-52392-49195-49199-49172-49171-157-156-53-47,65281-0-11-10-35-5-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788969281, "last_seen": 1788969281, "transport": "t", "ja3_hash": "99a632928316866652915a5047a5a107", "ja3_variant_count": 1, "ja3_variants": [ "99a632928316866652915a5047a5a107" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 13 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_6e6a4a4a64f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "6e6a4a4a64f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-16-23-65281-43-65037-45-18-17613-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788773204, "last_seen": 1788773204, "transport": "t", "ja3_hash": "f8c97366613b2bb39d0d588112b51bb3", "ja3_variant_count": 1, "ja3_variants": [ "f8c97366613b2bb39d0d588112b51bb3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_72768dcc6564", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "72768dcc6564", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-27-18-16-43-65037-17613-10-35-65281-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789747341, "last_seen": 1789747341, "transport": "t", "ja3_hash": "62308b41079bf430d7139d53d5a9bbdc", "ja3_variant_count": 1, "ja3_variants": [ "62308b41079bf430d7139d53d5a9bbdc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_78382a807abb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "78382a807abb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-43-27-23-65037-13-51764-0-11-65281-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789916703, "last_seen": 1789916703, "transport": "t", "ja3_hash": "1032ffe058c67fded148f3387cba7042", "ja3_variant_count": 1, "ja3_variants": [ "1032ffe058c67fded148f3387cba7042" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_7e731154e039", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "7e731154e039", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-45-65281-27-35-0-17613-11-16-65037-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788965622, "last_seen": 1788965622, "transport": "t", "ja3_hash": "a24d65d6706c542f02925e71005f920f", "ja3_variant_count": 1, "ja3_variants": [ "a24d65d6706c542f02925e71005f920f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_89e35bb783b0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "89e35bb783b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-17613-16-18-13-5-10-45-27-0-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788796422, "last_seen": 1788796422, "transport": "t", "ja3_hash": "101ef22b0e8c1a343795b6aaedacb78c", "ja3_variant_count": 1, "ja3_variants": [ "101ef22b0e8c1a343795b6aaedacb78c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_8aced9fd2cb2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "8aced9fd2cb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-10-65037-43-23-13-17613-5-11-18-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789442585, "last_seen": 1789442585, "transport": "t", "ja3_hash": "b329be24ba9f3d2c11f5caeaf27f640e", "ja3_variant_count": 1, "ja3_variants": [ "b329be24ba9f3d2c11f5caeaf27f640e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_96778415096c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "96778415096c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-43-35-16-65281-18-27-0-23-45-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788832432, "last_seen": 1788832432, "transport": "t", "ja3_hash": "3b8f40437b6fb3754a4af80ee9cdd172", "ja3_variant_count": 1, "ja3_variants": [ "3b8f40437b6fb3754a4af80ee9cdd172" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_9ebd5de6b76b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "9ebd5de6b76b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-16-5-11-43-10-35-18-0-65037-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788825880, "last_seen": 1788825880, "transport": "t", "ja3_hash": "66117a12ad5a1e2b7f939d9ffa40763b", "ja3_variant_count": 1, "ja3_variants": [ "66117a12ad5a1e2b7f939d9ffa40763b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_a9bdf17bbfe5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "a9bdf17bbfe5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-65281-17613-18-13-45-43-16-35-11-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789940848, "last_seen": 1789940848, "transport": "t", "ja3_hash": "d40b35cfa4471812ddb55b022f69913c", "ja3_variant_count": 1, "ja3_variants": [ "d40b35cfa4471812ddb55b022f69913c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 23 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_aee3e2e2383b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "aee3e2e2383b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-16-27-18-65037-11-23-43-5-45-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788993223, "last_seen": 1788993223, "transport": "t", "ja3_hash": "6cf64b3fbf1d394285704e698987d35b", "ja3_variant_count": 1, "ja3_variants": [ "6cf64b3fbf1d394285704e698987d35b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_bea6476a73be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "bea6476a73be", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-65281-23-16-13-43-18-11-0-27-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789865342, "last_seen": 1789865342, "transport": "t", "ja3_hash": "f3cf5d2910ddd1c627cf7f9f96297056", "ja3_variant_count": 1, "ja3_variants": [ "f3cf5d2910ddd1c627cf7f9f96297056" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_c79483be1dd3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "c79483be1dd3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-5-65281-43-65037-35-17613-0-11-13-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789026977, "last_seen": 1789026977, "transport": "t", "ja3_hash": "b7166d2b18c56a2038633e7486ba056a", "ja3_variant_count": 1, "ja3_variants": [ "b7166d2b18c56a2038633e7486ba056a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 22 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_cefc46783ee6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "cefc46783ee6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-27-65281-5-0-17613-45-10-35-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788988700, "last_seen": 1789009114, "transport": "t", "ja3_hash": "3edfffc4133e1708c302cb93f2ad6c91", "ja3_variant_count": 2, "ja3_variants": [ "3edfffc4133e1708c302cb93f2ad6c91", "e9649cd2f4747e3757cba0df5c0a3377" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_d763035bca24", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "d763035bca24", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-11-13-65281-27-5-16-35-23-65037-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789691881, "last_seen": 1789691881, "transport": "t", "ja3_hash": "2db5eed20595ed89a3239e0c060e31d8", "ja3_variant_count": 1, "ja3_variants": [ "2db5eed20595ed89a3239e0c060e31d8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_ec2f78d3f639", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "ec2f78d3f639", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-27-43-16-65037-23-10-0-18-17613-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788874795, "last_seen": 1788874795, "transport": "t", "ja3_hash": "81adfafd60c0cae72cf64c557d314b4e", "ja3_variant_count": 1, "ja3_variants": [ "81adfafd60c0cae72cf64c557d314b4e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_ed77f63a2c77", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "ed77f63a2c77", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-0-35-65037-43-10-65281-11-18-16-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789829292, "last_seen": 1789829292, "transport": "t", "ja3_hash": "fdb892c542380681d11e35ddd07fadc8", "ja3_variant_count": 1, "ja3_variants": [ "fdb892c542380681d11e35ddd07fadc8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 4 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_f82d63d7ad13", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "f82d63d7ad13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-43-18-16-23-27-65037-0-11-35-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789695879, "last_seen": 1789695879, "transport": "t", "ja3_hash": "ef0df8cef17e5ef07397d0347447c95d", "ja3_variant_count": 1, "ja3_variants": [ "ef0df8cef17e5ef07397d0347447c95d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513ht_8daaf6152771_00d42c2875f9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513ht", "b": "8daaf6152771", "c": "00d42c2875f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-43-23-10-0-35-27-65037-16-18-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789629099, "last_seen": 1789630911, "transport": "t", "ja3_hash": "a6cc81c9d61c2ddee8abd4f97afc35df", "ja3_variant_count": 2, "ja3_variants": [ "a6cc81c9d61c2ddee8abd4f97afc35df", "3caddc0515b8c034fd0f859f62a5b2bc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513ht_8daaf6152771_237b8edbb796", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513ht", "b": "8daaf6152771", "c": "237b8edbb796", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-5-35-18-65281-16-11-0-45-23-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788888895, "last_seen": 1789633548, "transport": "t", "ja3_hash": "deaed41ace98c51fce09f2feb18ebfea", "ja3_variant_count": 2, "ja3_variants": [ "deaed41ace98c51fce09f2feb18ebfea", "db74db2237b905b8da2b2c84bb05032e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513ht_8daaf6152771_292b84349f7b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513ht", "b": "8daaf6152771", "c": "292b84349f7b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-23-10-5-35-43-0-16-27-65037-45-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788831553, "last_seen": 1788831553, "transport": "t", "ja3_hash": "a67e0d9c965d64eb31d2644926633701", "ja3_variant_count": 1, "ja3_variants": [ "a67e0d9c965d64eb31d2644926633701" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513ht_8daaf6152771_4b807bfb6224", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513ht", "b": "8daaf6152771", "c": "4b807bfb6224", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-65281-5-11-16-0-13-18-43-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788829756, "last_seen": 1788829756, "transport": "t", "ja3_hash": "8a8d95e916a3c8454e706b53b121a6e2", "ja3_variant_count": 1, "ja3_variants": [ "8a8d95e916a3c8454e706b53b121a6e2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513ht_8daaf6152771_51ad43904754", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513ht", "b": "8daaf6152771", "c": "51ad43904754", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-27-23-11-43-35-65037-0-16-45-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788861439, "last_seen": 1788861439, "transport": "t", "ja3_hash": "ed27ee66432fd38486295096b6438376", "ja3_variant_count": 1, "ja3_variants": [ "ed27ee66432fd38486295096b6438376" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513ht_8daaf6152771_675055f0b104", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513ht", "b": "8daaf6152771", "c": "675055f0b104", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-43-13-23-65037-16-5-27-0-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788869628, "last_seen": 1788869628, "transport": "t", "ja3_hash": "490d89963d718dd320d5764f84143071", "ja3_variant_count": 1, "ja3_variants": [ "490d89963d718dd320d5764f84143071" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513ht_8daaf6152771_d6448d7c7d14", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513ht", "b": "8daaf6152771", "c": "d6448d7c7d14", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-65281-18-23-65037-13-16-11-5-10-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788791982, "last_seen": 1788791982, "transport": "t", "ja3_hash": "c6921c616af152b4f6fdf3cd3e96e7fd", "ja3_variant_count": 1, "ja3_variants": [ "c6921c616af152b4f6fdf3cd3e96e7fd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_25f0be3a1e97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "25f0be3a1e97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-13-18-17613-11-27-23-10-43-45-65281-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789702105, "last_seen": 1789702105, "transport": "t", "ja3_hash": "aba3d0055624d4f159ba5b6a58fd5c60", "ja3_variant_count": 1, "ja3_variants": [ "aba3d0055624d4f159ba5b6a58fd5c60" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_3776db13d599", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "3776db13d599", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-65037-65281-10-43-45-13-27-23-17613-5-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789415510, "last_seen": 1789415510, "transport": "t", "ja3_hash": "17e31c527444d2b12ff198723a53f40e", "ja3_variant_count": 1, "ja3_variants": [ "17e31c527444d2b12ff198723a53f40e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 87 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_3cbc34f036de", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "3cbc34f036de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-18-11-35-17613-0-5-43-23-10-65281-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788795822, "last_seen": 1788795822, "transport": "t", "ja3_hash": "3a432e2927f0bcb2d37673a2a3aac6fd", "ja3_variant_count": 1, "ja3_variants": [ "3a432e2927f0bcb2d37673a2a3aac6fd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_436de45e9bf8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "436de45e9bf8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-17613-5-0-27-45-11-18-10-35-43-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789077104, "last_seen": 1789077104, "transport": "t", "ja3_hash": "120149ee17d4f73d8a2893b35755a368", "ja3_variant_count": 1, "ja3_variants": [ "120149ee17d4f73d8a2893b35755a368" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 12 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_57850826d68e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "57850826d68e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-43-11-17613-65281-45-27-35-23-0-18-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789029155, "last_seen": 1789029155, "transport": "t", "ja3_hash": "4fce7f5f409882b7b158662be967530d", "ja3_variant_count": 1, "ja3_variants": [ "4fce7f5f409882b7b158662be967530d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_6be373f0c26e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "6be373f0c26e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-13-45-0-43-65037-35-10-27-18-51764-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789737263, "last_seen": 1789737263, "transport": "t", "ja3_hash": "33c196d9c51ea3d6b1fa130428d94825", "ja3_variant_count": 1, "ja3_variants": [ "33c196d9c51ea3d6b1fa130428d94825" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_84573da81a30", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "84573da81a30", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-65281-23-11-35-51764-17613-43-45-0-5-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811270, "last_seen": 1788811270, "transport": "t", "ja3_hash": "9694b008c6bd00caf31d03231cb85916", "ja3_variant_count": 1, "ja3_variants": [ "9694b008c6bd00caf31d03231cb85916" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_b5e2e20639b4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "b5e2e20639b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,23-18-0-35-65037-17613-43-5-45-27-11-10-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789472901, "last_seen": 1789472901, "transport": "t", "ja3_hash": "19fabe3db3713859b5ab069976d2c084", "ja3_variant_count": 1, "ja3_variants": [ "19fabe3db3713859b5ab069976d2c084" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_d2b6939ed5a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "d2b6939ed5a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-11-10-65281-45-35-43-5-13-0-65037-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789704982, "last_seen": 1789704982, "transport": "t", "ja3_hash": "366053d3e122c1eb80581f97365f976c", "ja3_variant_count": 1, "ja3_variants": [ "366053d3e122c1eb80581f97365f976c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_08908b984a28", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "08908b984a28", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-43-65037-23-13-65281-10-45-35-16-17613-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789026483, "last_seen": 1789026483, "transport": "t", "ja3_hash": "03f0b0862621c2daa9b3be6360e3baaf", "ja3_variant_count": 1, "ja3_variants": [ "03f0b0862621c2daa9b3be6360e3baaf" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_1af6631553a8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "1af6631553a8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,65281-0-11-10-35-5-16-22-18-23-13-43-45-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789598691, "last_seen": 1789599462, "transport": "t", "ja3_hash": "39c3927f95d037dc484a0772d6e1fce6", "ja3_variant_count": 1, "ja3_variants": [ "39c3927f95d037dc484a0772d6e1fce6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0": 43 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_1fc5fc5b7724", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "1fc5fc5b7724", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-11-43-65281-65037-27-13-16-45-23-10-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789682187, "last_seen": 1789830396, "transport": "t", "ja3_hash": "4e4c3b5b68cf10a793e7529288103ef3", "ja3_variant_count": 2, "ja3_variants": [ "4e4c3b5b68cf10a793e7529288103ef3", "4a88e653c4fede9e6fa9248cdbaf38ee" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_20bc6c80d639", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "20bc6c80d639", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-27-16-23-10-65281-0-43-17613-11-65037-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788934373, "last_seen": 1788934373, "transport": "t", "ja3_hash": "0f53e7a533389168984f7225835ae667", "ja3_variant_count": 1, "ja3_variants": [ "0f53e7a533389168984f7225835ae667" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_24fc7448ae61", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "24fc7448ae61", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-16-10-23-0-13-18-27-45-35-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788767141, "last_seen": 1789502151, "transport": "t", "ja3_hash": "7b4290b083084a34ac816b26a699165c", "ja3_variant_count": 2, "ja3_variants": [ "7b4290b083084a34ac816b26a699165c", "25978cbbce99d2039efb8dd3827fea59" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_25248d527c53", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "25248d527c53", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-0-13-11-17613-23-35-18-43-27-65281-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789690667, "last_seen": 1789690667, "transport": "t", "ja3_hash": "c45cbee7a8edf21231012830cf5c29dd", "ja3_variant_count": 1, "ja3_variants": [ "c45cbee7a8edf21231012830cf5c29dd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_2c4db0fc2997", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "2c4db0fc2997", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-18-10-65037-23-27-35-43-45-11-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788783555, "last_seen": 1788789466, "transport": "t", "ja3_hash": "440d1c907c537b58200482514d1ca81a", "ja3_variant_count": 2, "ja3_variants": [ "440d1c907c537b58200482514d1ca81a", "eb898aeca257c5db3bfbcbe46ffa93b3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_31b64f9ffad3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "31b64f9ffad3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-17613-45-65281-35-27-23-5-16-43-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789681096, "last_seen": 1789919924, "transport": "t", "ja3_hash": "c5b34641cfeab90308952884c743334f", "ja3_variant_count": 2, "ja3_variants": [ "c5b34641cfeab90308952884c743334f", "0a4eec5be91996a196dddc6dfa9838d0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 9 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_3c25478c7562", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "3c25478c7562", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-0-18-16-11-10-65281-35-17613-45-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789921606, "last_seen": 1789921606, "transport": "t", "ja3_hash": "e157eca96f150ead7c8ac0ba53324045", "ja3_variant_count": 1, "ja3_variants": [ "e157eca96f150ead7c8ac0ba53324045" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 35 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_45e3c4ab240f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "45e3c4ab240f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-65281-35-18-11-43-0-5-65037-13-27-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789235836, "last_seen": 1789235836, "transport": "t", "ja3_hash": "d1ab5a254d4d5ff33161cacec032f761", "ja3_variant_count": 1, "ja3_variants": [ "d1ab5a254d4d5ff33161cacec032f761" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_474d83e5ce4d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "474d83e5ce4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-0-65281-43-35-51764-11-10-16-5-13-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723975, "last_seen": 1788723975, "transport": "t", "ja3_hash": "20b7da36ba1531f17c19306b46d13f63", "ja3_variant_count": 1, "ja3_variants": [ "20b7da36ba1531f17c19306b46d13f63" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_4a4465664e59", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "4a4465664e59", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-5-18-35-65037-43-13-27-65281-23-45-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789269657, "last_seen": 1789269657, "transport": "t", "ja3_hash": "3a3e8e5cd4b8f2051cf277b6f94f96f1", "ja3_variant_count": 1, "ja3_variants": [ "3a3e8e5cd4b8f2051cf277b6f94f96f1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 17 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_4c3e36eb8b85", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "4c3e36eb8b85", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-13-11-65037-35-18-17613-43-0-65281-23-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789396232, "last_seen": 1789396232, "transport": "t", "ja3_hash": "8cca44818664659bb397c8f50d910db0", "ja3_variant_count": 1, "ja3_variants": [ "8cca44818664659bb397c8f50d910db0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_4d8205f39aa6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "4d8205f39aa6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-17613-65281-43-11-0-51764-27-45-23-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789501598, "last_seen": 1789501598, "transport": "t", "ja3_hash": "73713b939a398efffa35861353d3c8e7", "ja3_variant_count": 1, "ja3_variants": [ "73713b939a398efffa35861353d3c8e7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_51f2d258eab7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "51f2d258eab7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-5-35-23-13-65037-27-43-16-10-45-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788763915, "last_seen": 1789689009, "transport": "t", "ja3_hash": "f29c83f7c1a8752506257f13b9b623df", "ja3_variant_count": 2, "ja3_variants": [ "f29c83f7c1a8752506257f13b9b623df", "163334d30b759acac66983e0dc752aa2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_56c108fb2cc0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "56c108fb2cc0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-43-65281-23-17613-65037-16-5-45-11-35-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789638166, "last_seen": 1789638166, "transport": "t", "ja3_hash": "de965c29e6a44db08fe64f8a7d0ff91d", "ja3_variant_count": 1, "ja3_variants": [ "de965c29e6a44db08fe64f8a7d0ff91d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_5786766816c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "5786766816c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-35-11-0-43-65037-5-18-27-16-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789275261, "last_seen": 1789275261, "transport": "t", "ja3_hash": "68ccceff0cfc1ae9a8834907565ab436", "ja3_variant_count": 1, "ja3_variants": [ "68ccceff0cfc1ae9a8834907565ab436" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_59b0e2bfbd0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "59b0e2bfbd0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65037-45-65281-23-0-5-11-43-18-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789693282, "last_seen": 1789693282, "transport": "t", "ja3_hash": "5ef0f58f3d061ab3898319a939796138", "ja3_variant_count": 1, "ja3_variants": [ "5ef0f58f3d061ab3898319a939796138" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_636a2ff460f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "636a2ff460f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-65281-0-11-5-43-23-27-13-17613-18-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789052254, "last_seen": 1789052254, "transport": "t", "ja3_hash": "7860bc4b9cf41f19845caf9fe5729b47", "ja3_variant_count": 1, "ja3_variants": [ "7860bc4b9cf41f19845caf9fe5729b47" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_63eb582b2506", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "63eb582b2506", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-16-18-45-17613-27-65037-43-23-13-65281-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789811875, "last_seen": 1789811875, "transport": "t", "ja3_hash": "a0628ae4f53a3981c4e7da92b9185929", "ja3_variant_count": 1, "ja3_variants": [ "a0628ae4f53a3981c4e7da92b9185929" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_63fb81e2e0b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "63fb81e2e0b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-0-10-45-35-11-16-13-65281-27-18-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789523451, "last_seen": 1789523451, "transport": "t", "ja3_hash": "d6e2de2d6344c2d60511f17509f74774", "ja3_variant_count": 1, "ja3_variants": [ "d6e2de2d6344c2d60511f17509f74774" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_73cbf7a5c573", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "73cbf7a5c573", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-49172-49171-157-156-53-47,0-5-10-11-16-17-23-35-13-43-45-50-51-65281,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788075527, "last_seen": 1789967070, "transport": "t", "ja3_hash": "aa5064e82d8717fcdf164fa9d77b78bb", "ja3_variant_count": 1, "ja3_variants": [ "aa5064e82d8717fcdf164fa9d77b78bb" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36": 12, "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/20.0.1132.57 Safari/537.36": 1, "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.17 (KHTML, like Gecko) Chrome/11.0.654.0 Safari/534.17": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_73f68b58e4af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "73f68b58e4af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-43-27-5-0-35-16-17613-10-18-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788795480, "last_seen": 1788799303, "transport": "t", "ja3_hash": "c9ae3f14e21aca24a27f85b887f8a20a", "ja3_variant_count": 2, "ja3_variants": [ "c9ae3f14e21aca24a27f85b887f8a20a", "46bdf497960bb9a7d8788affb24f1514" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_7c8059000ff8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "7c8059000ff8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-65037-18-16-35-11-13-23-10-65281-27-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789829437, "last_seen": 1789829437, "transport": "t", "ja3_hash": "70976336d36e1ffa94fa2a81607fad6a", "ja3_variant_count": 1, "ja3_variants": [ "70976336d36e1ffa94fa2a81607fad6a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_7f5581f3f044", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "7f5581f3f044", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-10-16-23-45-11-13-27-18-65281-17513-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789224362, "last_seen": 1789224362, "transport": "t", "ja3_hash": "3759d068d6b13600fd3272af231df098", "ja3_variant_count": 1, "ja3_variants": [ "3759d068d6b13600fd3272af231df098" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_80f5501927c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "80f5501927c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-65281-43-11-13-16-18-35-17613-27-45-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788454162, "last_seen": 1788454162, "transport": "t", "ja3_hash": "bfdfa69ef7cf12d18b594e4336caa3df", "ja3_variant_count": 1, "ja3_variants": [ "bfdfa69ef7cf12d18b594e4336caa3df" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 43 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_8c454e6c488f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "8c454e6c488f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-28-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 59, "first_seen": 1787726589, "last_seen": 1789846084, "transport": "t", "ja3_hash": "1aa04f421fd20265d395398fdc1d1d23", "ja3_variant_count": 2, "ja3_variants": [ "1aa04f421fd20265d395398fdc1d1d23", "187137a9915871bcf05509b22adf6537" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 38, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 92, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 1199, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 22, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 84 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_9015387edb43", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "9015387edb43", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-51764-65281-16-0-35-65037-18-10-45-23-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789582329, "last_seen": 1789582329, "transport": "t", "ja3_hash": "f2437466f626e816a5316ee15ce33f9d", "ja3_variant_count": 1, "ja3_variants": [ "f2437466f626e816a5316ee15ce33f9d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_9245dac68252", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "9245dac68252", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-51764-17613-43-65037-35-11-13-27-0-10-16-51,514-4588-24-23-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789387675, "last_seen": 1789387675, "transport": "t", "ja3_hash": "9841fd4d17bb9d0192b1860ba1a0d2b8", "ja3_variant_count": 1, "ja3_variants": [ "9841fd4d17bb9d0192b1860ba1a0d2b8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_92622c545fa6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "92622c545fa6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-0-45-27-65037-13-65281-17613-35-11-23-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788763987, "last_seen": 1788924192, "transport": "t", "ja3_hash": "65879add1ca6d80fa5c93680092286ea", "ja3_variant_count": 2, "ja3_variants": [ "65879add1ca6d80fa5c93680092286ea", "697860f34549d922c4d0e7c648c5f5f0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_93cd10c2e207", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "93cd10c2e207", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-11-10-35-5-16-22-18-23-13-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 51, "first_seen": 1787499444, "last_seen": 1789730770, "transport": "t", "ja3_hash": "b02badf706ed5d554852e0e875725f7c", "ja3_variant_count": 1, "ja3_variants": [ "b02badf706ed5d554852e0e875725f7c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 43 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_985d6b6ad2d2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "985d6b6ad2d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51764-13-65037-16-0-11-17613-65281-18-43-35-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789912451, "last_seen": 1789912451, "transport": "t", "ja3_hash": "206065595478d0ad1bd9bff24c62f173", "ja3_variant_count": 1, "ja3_variants": [ "206065595478d0ad1bd9bff24c62f173" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_a65c741dc333", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "a65c741dc333", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-45-13-10-5-16-65281-0-11-43-65037-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789744534, "last_seen": 1789744534, "transport": "t", "ja3_hash": "dea7a5f1b635ee21b77d5775dfa052a1", "ja3_variant_count": 1, "ja3_variants": [ "dea7a5f1b635ee21b77d5775dfa052a1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_a9bc28779ae8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "a9bc28779ae8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-65037-45-11-65281-43-0-27-35-23-13-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789190608, "last_seen": 1789190608, "transport": "t", "ja3_hash": "81316e82d8d0e5db8cd69d9074169042", "ja3_variant_count": 1, "ja3_variants": [ "81316e82d8d0e5db8cd69d9074169042" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_aaa5fd0a57d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "aaa5fd0a57d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-11-0-27-16-65037-13-23-17613-5-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789688985, "last_seen": 1789688985, "transport": "t", "ja3_hash": "21f165607b7a60f65f4266ac72340baf", "ja3_variant_count": 1, "ja3_variants": [ "21f165607b7a60f65f4266ac72340baf" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_aae909b7a6e3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "aae909b7a6e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-13-65037-17613-27-43-23-5-18-11-0-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788582204, "last_seen": 1788582204, "transport": "t", "ja3_hash": "106e2c9296ee7a636272e043b90cb795", "ja3_variant_count": 1, "ja3_variants": [ "106e2c9296ee7a636272e043b90cb795" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_af25c18464fc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "af25c18464fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-43-16-35-0-10-65281-45-18-13-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788535353, "last_seen": 1789518374, "transport": "t", "ja3_hash": "5158ddd54173111fc158d72fd95bf04a", "ja3_variant_count": 2, "ja3_variants": [ "5158ddd54173111fc158d72fd95bf04a", "a32f87e0a9a26d094c2d81de65b695ce" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_b3aa51c49899", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "b3aa51c49899", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-0-16-13-17613-43-5-11-23-35-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788797782, "last_seen": 1788836064, "transport": "t", "ja3_hash": "28f6a9ea0f3892c94268382120c8e799", "ja3_variant_count": 2, "ja3_variants": [ "28f6a9ea0f3892c94268382120c8e799", "fb48dcb6ca31613f0bb40850d7c1814c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_b8fcc8ee221f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "b8fcc8ee221f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-13-10-43-16-27-18-17613-65281-0-45-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789789520, "last_seen": 1789789520, "transport": "t", "ja3_hash": "f1f6e843bd249e0f36c29386551d54e7", "ja3_variant_count": 1, "ja3_variants": [ "f1f6e843bd249e0f36c29386551d54e7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36 OPR/101.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_bce322f8abc7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "bce322f8abc7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-45-43-65037-11-5-0-17613-10-65281-27-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788805608, "last_seen": 1789421782, "transport": "t", "ja3_hash": "f4f6af799e4cccb46f2f4ea019acb0fd", "ja3_variant_count": 2, "ja3_variants": [ "f4f6af799e4cccb46f2f4ea019acb0fd", "cc7daabbfd4e1bd12ccc2d935cb93105" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d53ef77a7cb2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d53ef77a7cb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-5-16-65037-17613-65281-27-0-11-13-10-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788572619, "last_seen": 1788572619, "transport": "t", "ja3_hash": "3b1b7f33b9db6531e252319f1f73e359", "ja3_variant_count": 1, "ja3_variants": [ "3b1b7f33b9db6531e252319f1f73e359" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d776d99b8999", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d776d99b8999", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-17613-10-11-43-0-13-23-16-45-65037-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788849016, "last_seen": 1788849016, "transport": "t", "ja3_hash": "7cf01c4502e3abebc6b9c1a178f64a1b", "ja3_variant_count": 1, "ja3_variants": [ "7cf01c4502e3abebc6b9c1a178f64a1b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_df425e601b1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "df425e601b1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-18-17613-45-43-16-35-11-23-65281-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788760894, "last_seen": 1788760894, "transport": "t", "ja3_hash": "81e698e8b7c0489ac466a402db219ed8", "ja3_variant_count": 1, "ja3_variants": [ "81e698e8b7c0489ac466a402db219ed8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_e344b0713dc8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "e344b0713dc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-0-45-43-23-65037-51764-18-16-13-11-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723979, "last_seen": 1788723979, "transport": "t", "ja3_hash": "e8c55506b8723554201e4b0766bff714", "ja3_variant_count": 1, "ja3_variants": [ "e8c55506b8723554201e4b0766bff714" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_e6531b609eba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "e6531b609eba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-16-17613-65281-13-23-45-43-5-10-27-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788619031, "last_seen": 1788619031, "transport": "t", "ja3_hash": "a017a2d758e238464ef2b16a0f4bfad4", "ja3_variant_count": 1, "ja3_variants": [ "a017a2d758e238464ef2b16a0f4bfad4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_e6e287f79e91", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "e6e287f79e91", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-16-17613-0-11-65281-65037-45-35-18-43-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788815253, "last_seen": 1789829352, "transport": "t", "ja3_hash": "c97630f3c23c6234e5229453abcf8bba", "ja3_variant_count": 3, "ja3_variants": [ "c97630f3c23c6234e5229453abcf8bba", "b902d2704afa35e5fe6bf9dbbeac34c8", "697d7347a18e8b06856101780be4e3a4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 14, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_e771cc5dc58e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "e771cc5dc58e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-17613-16-10-23-27-0-18-43-65037-5-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789027880, "last_seen": 1789027880, "transport": "t", "ja3_hash": "7c67d9664a0d23695f3b8d86c69420fb", "ja3_variant_count": 1, "ja3_variants": [ "7c67d9664a0d23695f3b8d86c69420fb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_f4f0fb6c2e78", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "f4f0fb6c2e78", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-10-27-65281-43-23-0-17613-18-13-65037-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788782448, "last_seen": 1788782448, "transport": "t", "ja3_hash": "f1a4bfb964cf8837d62cccf9e28c6831", "ja3_variant_count": 1, "ja3_variants": [ "f1a4bfb964cf8837d62cccf9e28c6831" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_f50a2d4aa895", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "f50a2d4aa895", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-65037-18-0-27-11-13-23-16-10-17613-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789189102, "last_seen": 1789189102, "transport": "t", "ja3_hash": "52fb0e80cbf81248a7620a7d5a98d10b", "ja3_variant_count": 1, "ja3_variants": [ "52fb0e80cbf81248a7620a7d5a98d10b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 242 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_f924904747ba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "f924904747ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 52, "first_seen": 1787631594, "last_seen": 1789691481, "transport": "t", "ja3_hash": "3e9b20610098b6c9bff953856e58016a", "ja3_variant_count": 2, "ja3_variants": [ "3e9b20610098b6c9bff953856e58016a", "87a6e6799ead1f216ceb3988e4b7a0dd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 54, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 36, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13d1514ht_8daaf6152771_27a5679c8955", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514ht", "b": "8daaf6152771", "c": "27a5679c8955", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-13-65037-27-43-0-45-10-18-11-16-5-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789968059, "last_seen": 1789968059, "transport": "t", "ja3_hash": "8e6869822a6f534785555f7ac26cc326", "ja3_variant_count": 1, "ja3_variants": [ "8e6869822a6f534785555f7ac26cc326" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514ht_8daaf6152771_2c4db0fc2997", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514ht", "b": "8daaf6152771", "c": "2c4db0fc2997", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-11-18-13-10-23-65037-0-16-5-43-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788865135, "last_seen": 1788865135, "transport": "t", "ja3_hash": "0ca37ccc8a14972683f2271dbfe88d40", "ja3_variant_count": 1, "ja3_variants": [ "0ca37ccc8a14972683f2271dbfe88d40" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514ht_8daaf6152771_51f2d258eab7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514ht", "b": "8daaf6152771", "c": "51f2d258eab7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-23-5-43-13-45-65037-16-27-65281-10-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788821819, "last_seen": 1789625063, "transport": "t", "ja3_hash": "d1624fc03d6deadc46d51a1f6e905c24", "ja3_variant_count": 3, "ja3_variants": [ "d1624fc03d6deadc46d51a1f6e905c24", "88fa2a95f3050e7d99351db268b7aeaf", "e19b05d8a1d285b20a0249c4715f9707" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514ht_8daaf6152771_63fb81e2e0b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514ht", "b": "8daaf6152771", "c": "63fb81e2e0b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-13-0-65281-16-45-23-35-5-27-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788884497, "last_seen": 1789166957, "transport": "t", "ja3_hash": "12202490a511d2fbf8a1af364057f8e0", "ja3_variant_count": 2, "ja3_variants": [ "12202490a511d2fbf8a1af364057f8e0", "31d243e3f5d7032c2909d44e4d38ffea" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514ht_8daaf6152771_73cbf7a5c573", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514ht", "b": "8daaf6152771", "c": "73cbf7a5c573", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-10-11-16-17-23-35-13-43-45-50-51-65281,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789539263, "last_seen": 1789539263, "transport": "t", "ja3_hash": "4c29139ef11717f4ea726dc6572387ed", "ja3_variant_count": 1, "ja3_variants": [ "4c29139ef11717f4ea726dc6572387ed" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36/Nutch-1.23-SNAPSHOT": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514ht_8daaf6152771_7c8059000ff8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514ht", "b": "8daaf6152771", "c": "7c8059000ff8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-45-18-65281-11-43-0-23-65037-10-16-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788827485, "last_seen": 1788827485, "transport": "t", "ja3_hash": "733ad6b096c689e563a870d53292f103", "ja3_variant_count": 1, "ja3_variants": [ "733ad6b096c689e563a870d53292f103" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514ht_8daaf6152771_7f4af075a959", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514ht", "b": "8daaf6152771", "c": "7f4af075a959", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-65281-16-65037-0-27-5-11-35-13-45-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788864886, "last_seen": 1789884021, "transport": "t", "ja3_hash": "672df87216d8f8592dff8d9f7af5d563", "ja3_variant_count": 3, "ja3_variants": [ "672df87216d8f8592dff8d9f7af5d563", "1a02f57fec0d2a87a6c2c821c4c73f31", "7fd9d0a77d36405440f7105be2b3b692" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514ht_8daaf6152771_c5b669d7a290", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514ht", "b": "8daaf6152771", "c": "c5b669d7a290", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-0-27-65281-23-65037-18-13-5-43-45-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788702249, "last_seen": 1789637904, "transport": "t", "ja3_hash": "077d56aa6d1f473604fc859d40740501", "ja3_variant_count": 3, "ja3_variants": [ "077d56aa6d1f473604fc859d40740501", "0d37b32aa9f3b5ed5d906007c35434b6", "323e7699b7b3c973a3dcf83e1835f0c6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514ht_8daaf6152771_cd3db9fb5bd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514ht", "b": "8daaf6152771", "c": "cd3db9fb5bd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-18-13-0-45-10-16-23-65281-43-35-5-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788833243, "last_seen": 1788833243, "transport": "t", "ja3_hash": "86b097ea87c4d8918712f003c440f3ff", "ja3_variant_count": 1, "ja3_variants": [ "86b097ea87c4d8918712f003c440f3ff" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514ht_8daaf6152771_d0a515fc23e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514ht", "b": "8daaf6152771", "c": "d0a515fc23e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-65281-5-35-43-16-23-0-18-11-45-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788831713, "last_seen": 1788849250, "transport": "t", "ja3_hash": "cb513a9f2aa78224b6de0ff35d8130e0", "ja3_variant_count": 3, "ja3_variants": [ "cb513a9f2aa78224b6de0ff35d8130e0", "506fca9110867abc6dae61786a402919", "fdd4c6988344805429a07739d2d4ecd9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514ht_8daaf6152771_f46fc8c2f2dc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514ht", "b": "8daaf6152771", "c": "f46fc8c2f2dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-0-10-65037-35-23-65281-11-45-43-16-27-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788963715, "last_seen": 1788963715, "transport": "t", "ja3_hash": "00e804f092b616828c596b73c6d9a36a", "ja3_variant_count": 1, "ja3_variants": [ "00e804f092b616828c596b73c6d9a36a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_8802cfb92a1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "8802cfb92a1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-13-45-11-65037-43-18-35-27-65281-10-0-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788998457, "last_seen": 1789909765, "transport": "t", "ja3_hash": "85e3bde0a2b011e00a1f2488331ed6e4", "ja3_variant_count": 4, "ja3_variants": [ "85e3bde0a2b011e00a1f2488331ed6e4", "940f99f268c1067d744dee10ca37d1dc", "59ae169ab6051cef733310ebbd239796", "732604fb5819a7d7be033aeb642475c5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_9743f096c268", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "9743f096c268", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-23-27-5-11-18-17613-45-13-43-51764-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789649710, "last_seen": 1789649710, "transport": "t", "ja3_hash": "41e10ca857eb930563957b61c05fc6c9", "ja3_variant_count": 1, "ja3_variants": [ "41e10ca857eb930563957b61c05fc6c9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_a9b214fcfaef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "a9b214fcfaef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-13-10-18-17613-43-65037-35-27-51764-5-0-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789652054, "last_seen": 1789652054, "transport": "t", "ja3_hash": "3a2d0e73d46efb58af90e470d719cd22", "ja3_variant_count": 1, "ja3_variants": [ "3a2d0e73d46efb58af90e470d719cd22" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_c9b03e83d227", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "c9b03e83d227", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-45-17613-51764-10-43-65037-18-35-65281-13-23-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788948603, "last_seen": 1788948603, "transport": "t", "ja3_hash": "7b15e1e63c90b9d8468e8c8ad1da1c7d", "ja3_variant_count": 1, "ja3_variants": [ "7b15e1e63c90b9d8468e8c8ad1da1c7d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_f856b9a3e94f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "f856b9a3e94f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-17613-0-27-45-23-10-65281-35-43-13-18-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788481096, "last_seen": 1789750615, "transport": "t", "ja3_hash": "1a9c7d5a98d1267a5b4ad1ff54e6d953", "ja3_variant_count": 3, "ja3_variants": [ "1a9c7d5a98d1267a5b4ad1ff54e6d953", "222657af2177f044416502328b5fd988", "0c08b31b39b4fdb36be24c0104779059" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_02f1fabc2700", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "02f1fabc2700", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-18-5-23-35-17613-43-10-16-65281-13-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788761043, "last_seen": 1788796285, "transport": "t", "ja3_hash": "54fd2b4bcd5444bbbd23e6938dc99b1c", "ja3_variant_count": 3, "ja3_variants": [ "54fd2b4bcd5444bbbd23e6938dc99b1c", "f6f43dabbdc18cba982d86e2a8f24378", "a983a9f34c0f3547ddac114a948c2aa1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_10e451ee1749", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "10e451ee1749", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-65037-17613-45-35-0-18-11-5-43-10-23-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788776209, "last_seen": 1789865339, "transport": "t", "ja3_hash": "07d0074decb76e9b35911334fb367688", "ja3_variant_count": 6, "ja3_variants": [ "07d0074decb76e9b35911334fb367688", "8ffec1d4d0a3cd2d9dd4d933562dafac", "ac92505edb032f17fcab2014d640b8c4", "5d854f999a433c265d9abf46edef11d8", "a0bcafcabfa1b5b613475a22362d0849", "f15495fac543b75526bff8e1277880fb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 16, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 15 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_1e2be553066d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "1e2be553066d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-11-51764-5-43-13-65037-0-35-45-65281-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788724239, "last_seen": 1788724239, "transport": "t", "ja3_hash": "bceccfcbf5f8d68dab0376df069df91a", "ja3_variant_count": 1, "ja3_variants": [ "bceccfcbf5f8d68dab0376df069df91a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_20ba22b4d1c7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "20ba22b4d1c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-0-18-45-10-65281-17613-35-11-43-4832-16-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789386546, "last_seen": 1789386546, "transport": "t", "ja3_hash": "b8bd1f0f2eb233e3ea79ece3a878d8fb", "ja3_variant_count": 1, "ja3_variants": [ "b8bd1f0f2eb233e3ea79ece3a878d8fb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 73 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_21c46195413c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "21c46195413c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-27-35-43-16-5-51764-18-45-10-11-65037-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723952, "last_seen": 1788723952, "transport": "t", "ja3_hash": "b19b5d9251535ff69b791fddc3c15788", "ja3_variant_count": 1, "ja3_variants": [ "b19b5d9251535ff69b791fddc3c15788" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_2b60c0550859", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "2b60c0550859", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-11-65281-17613-43-51764-65037-23-13-18-5-0-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811266, "last_seen": 1788811266, "transport": "t", "ja3_hash": "ff4bab102a20e3bff9f80e6c0b553be8", "ja3_variant_count": 1, "ja3_variants": [ "ff4bab102a20e3bff9f80e6c0b553be8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_2f4667ad99a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "2f4667ad99a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-0-11-17613-27-35-18-65281-16-45-10-51764-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789918132, "last_seen": 1789918132, "transport": "t", "ja3_hash": "5095e7749413258891efc2b3970377c0", "ja3_variant_count": 1, "ja3_variants": [ "5095e7749413258891efc2b3970377c0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_32db7dcf895c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "32db7dcf895c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788768244, "last_seen": 1788768246, "transport": "t", "ja3_hash": "a0d884cd3d06dc822dc54c133404637f", "ja3_variant_count": 1, "ja3_variants": [ "a0d884cd3d06dc822dc54c133404637f" ], "user_agents": { "Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 24 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_39f5dd78de51", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "39f5dd78de51", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-0-5-65281-17613-23-18-11-45-65037-35-43-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788570647, "last_seen": 1788570647, "transport": "t", "ja3_hash": "b5ec2c0e3b208f44f986c37e6ac4b341", "ja3_variant_count": 1, "ja3_variants": [ "b5ec2c0e3b208f44f986c37e6ac4b341" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_3a80aaee01b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "3a80aaee01b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-11-65037-65281-23-18-16-51764-10-45-27-0-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789658370, "last_seen": 1789658370, "transport": "t", "ja3_hash": "138d5b60d9408114c425f4981e63a9b6", "ja3_variant_count": 1, "ja3_variants": [ "138d5b60d9408114c425f4981e63a9b6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_40375c35c247", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "40375c35c247", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-10-65281-43-11-13-5-45-16-27-23-65037-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789750612, "last_seen": 1789750612, "transport": "t", "ja3_hash": "921f28261a34f47343d78b5f66795579", "ja3_variant_count": 1, "ja3_variants": [ "921f28261a34f47343d78b5f66795579" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_43b9d5534890", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "43b9d5534890", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-43-10-5-45-35-23-18-16-13-17613-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788653524, "last_seen": 1789086314, "transport": "t", "ja3_hash": "4aa830b6fab3a3f23142f956b5f74a71", "ja3_variant_count": 4, "ja3_variants": [ "4aa830b6fab3a3f23142f956b5f74a71", "2d40417b21ef81db2c7bf8ea85c06296", "d503355df53acfbb0e74bf1360932029", "079adcec5a6eb713b721e2f91026d140" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_534d800ff8ea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "534d800ff8ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-17613-65281-13-35-0-10-11-23-65037-43-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789051056, "last_seen": 1789051056, "transport": "t", "ja3_hash": "c43308510307e290839d45d516bd7b35", "ja3_variant_count": 1, "ja3_variants": [ "c43308510307e290839d45d516bd7b35" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_58797015d43b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "58797015d43b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-5-16-17613-45-11-35-13-27-0-43-65037-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788772007, "last_seen": 1789830227, "transport": "t", "ja3_hash": "d01cb944ccafe9b609d43ebd02127eb5", "ja3_variant_count": 4, "ja3_variants": [ "d01cb944ccafe9b609d43ebd02127eb5", "5bfffbc2aa3a8e6586990fa624e79533", "e472c5545b9cc7d55beb0d2f4f4249d8", "50d448b5d5914de3cafbd77ff6fe0d8f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": true } }, { "hash": "t13d1515h2_8daaf6152771_5ad411fbfabb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "5ad411fbfabb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 392, "first_seen": 1787668800, "last_seen": 1789846089, "transport": "t", "ja3_hash": "fa563217f31b34f217647ea3f3c35fc3", "ja3_variant_count": 3, "ja3_variants": [ "fa563217f31b34f217647ea3f3c35fc3", "de0ccdd4315ca1a05383e7f1dc3498f4", "b1814247ef25522b302946c6ace66e01" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 2125, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0": 4, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 97 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_704a515ad61d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "704a515ad61d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-5-51764-27-45-65037-43-10-18-35-11-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789584040, "last_seen": 1789584040, "transport": "t", "ja3_hash": "3ed7338dbee0953859950984bb922383", "ja3_variant_count": 1, "ja3_variants": [ "3ed7338dbee0953859950984bb922383" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_772d8e8a7b71", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "772d8e8a7b71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-45-35-0-17613-5-11-43-23-65037-18-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788670690, "last_seen": 1788670690, "transport": "t", "ja3_hash": "8c285ab1a93808acab8874aed30c8196", "ja3_variant_count": 1, "ja3_variants": [ "8c285ab1a93808acab8874aed30c8196" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_7fad7699c860", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "7fad7699c860", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-0-45-5-43-65281-27-23-65037-13-17613-16-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1788777278, "last_seen": 1789883039, "transport": "t", "ja3_hash": "66499b0bf6340b148aebab8d3623b986", "ja3_variant_count": 6, "ja3_variants": [ "66499b0bf6340b148aebab8d3623b986", "7b10b565a4338c590de7bb7548537eb8", "c09d616aa382f6204c5502a57b471eb9", "1ebd16ec4b39396011e3c424962fb48b", "dff7c6b54fdecb9afcafb6c63d6c3704", "1c40425f84dd7080f1731bfd970daa88" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_8112c01908d4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "8112c01908d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-27-65281-65037-13-45-43-23-17613-10-0-51764-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789669092, "last_seen": 1789669092, "transport": "t", "ja3_hash": "e249cda419a8b9fcd01618dbfee77234", "ja3_variant_count": 1, "ja3_variants": [ "e249cda419a8b9fcd01618dbfee77234" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_8371a4953894", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "8371a4953894", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-27-65281-17613-10-0-43-11-13-18-35-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789471566, "last_seen": 1789471566, "transport": "t", "ja3_hash": "fdb187aa180919d8d9e33135541ddde4", "ja3_variant_count": 1, "ja3_variants": [ "fdb187aa180919d8d9e33135541ddde4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_84a745f3a544", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "84a745f3a544", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-45-17613-16-27-10-0-11-18-65281-51764-43-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789711534, "last_seen": 1789711534, "transport": "t", "ja3_hash": "fc9384b9215041e7122c0e0b392340bb", "ja3_variant_count": 1, "ja3_variants": [ "fc9384b9215041e7122c0e0b392340bb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_9c4f4d4610bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "9c4f4d4610bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-0-23-65281-16-43-13-11-5-17613-65037-10-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788765345, "last_seen": 1788765345, "transport": "t", "ja3_hash": "702f26e04ec050bdbdbdd6bab5210a83", "ja3_variant_count": 1, "ja3_variants": [ "702f26e04ec050bdbdbdd6bab5210a83" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_a2bca2d53066", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "a2bca2d53066", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-5-23-35-13-45-0-17613-10-27-11-65037-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788761400, "last_seen": 1788967879, "transport": "t", "ja3_hash": "60a7c7642fb3529d2ff94ad30d3f65e6", "ja3_variant_count": 2, "ja3_variants": [ "60a7c7642fb3529d2ff94ad30d3f65e6", "d4c8ad8f35da2f77b94be08d753458d3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_a8a156b43da0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "a8a156b43da0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-18-16-43-35-23-27-11-0-5-13-45-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788705289, "last_seen": 1789843437, "transport": "t", "ja3_hash": "2689fad3f4918ca38287d12487094ce9", "ja3_variant_count": 4, "ja3_variants": [ "2689fad3f4918ca38287d12487094ce9", "ac94b6fadde6094d2315c5111aa68326", "4093785c279c5a0bc4f7a3415717e7fa", "d0679a432fd273cde88f5688ebd9d7f5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 25, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 4, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_aedf68495527", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "aedf68495527", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-45-28-65037-41,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788768244, "last_seen": 1788768244, "transport": "t", "ja3_hash": "bc87c51ff553fe2847b65cd13bd7ba23", "ja3_variant_count": 1, "ja3_variants": [ "bc87c51ff553fe2847b65cd13bd7ba23" ], "user_agents": { "Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_b088141deb13", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "b088141deb13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-18-65281-16-5-27-23-35-11-45-17513-10-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 53, "first_seen": 1788628530, "last_seen": 1789967250, "transport": "t", "ja3_hash": "6ce79781ca515e612862952961750f17", "ja3_variant_count": 7, "ja3_variants": [ "6ce79781ca515e612862952961750f17", "eca8ab166c18644955bc8280bf27b9d1", "182df799c043ca31650395010053e6d9", "b24b2457a5813a215a237dca11f8e56a", "5302f47017a7311d5131bc7f4e486f39", "e2d9108f8b28704da663ec5848e8c230", "d4a62770650492ebd2fff4f6bfdf2895" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.2436.95 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3843.181 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.2686.154 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_b7937e5a4377", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "b7937e5a4377", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-11-5-18-43-23-13-65281-17613-27-0-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788603276, "last_seen": 1789889713, "transport": "t", "ja3_hash": "a999b65816a9df2160d3c36dd2bebf46", "ja3_variant_count": 8, "ja3_variants": [ "a999b65816a9df2160d3c36dd2bebf46", "47585d2d903e0462810f7ffdd5d949eb", "72ba386b87ddde2efb6c405315eaa58c", "375e5dd0bc5c8cfc3b17e0cd882084fb", "1f0d049bcb0562f548ecef58a9ebf562", "1d2a5ad50ea7d055879f1913715f55bc", "44144805efff200ae483debb0a5cf269", "b85107729a847142591ed76b8997241c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 21, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 14, "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 11 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_b81810227705", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "b81810227705", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-51764-65281-5-23-13-17613-11-18-0-65037-35-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789002588, "last_seen": 1789002588, "transport": "t", "ja3_hash": "5fc2e66697fb9d683b941f46a01368b6", "ja3_variant_count": 1, "ja3_variants": [ "5fc2e66697fb9d683b941f46a01368b6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_c60aa3edd9fc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "c60aa3edd9fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-35-45-0-43-5-11-51764-13-65281-16-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788899612, "last_seen": 1788899612, "transport": "t", "ja3_hash": "e025488411e886105e6950a8564d338d", "ja3_variant_count": 1, "ja3_variants": [ "e025488411e886105e6950a8564d338d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_cb35a023dc6e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "cb35a023dc6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-18-16-27-11-5-65037-35-23-17613-43-10-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788891787, "last_seen": 1788891787, "transport": "t", "ja3_hash": "1c705c5a256ccb2ef786c15346935a64", "ja3_variant_count": 1, "ja3_variants": [ "1c705c5a256ccb2ef786c15346935a64" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_ecfb0be84e87", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "ecfb0be84e87", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-10-65281-11-13-17613-23-65037-27-43-16-45-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789671494, "last_seen": 1789671494, "transport": "t", "ja3_hash": "14ccf1f8dad03513e2d0c39b57f2728d", "ja3_variant_count": 1, "ja3_variants": [ "14ccf1f8dad03513e2d0c39b57f2728d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_ef8c11bf4bb0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "ef8c11bf4bb0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-16-65281-17613-35-10-65037-27-13-23-0-18-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789197835, "last_seen": 1789197835, "transport": "t", "ja3_hash": "01f74587b6ddd1b69e85223444a7e266", "ja3_variant_count": 1, "ja3_variants": [ "01f74587b6ddd1b69e85223444a7e266" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 11 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f1525dfe0d74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f1525dfe0d74", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-18-43-65281-65037-45-13-27-5-11-0-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788704058, "last_seen": 1789755537, "transport": "t", "ja3_hash": "9eaa45a7b1d28166397037c5c8906372", "ja3_variant_count": 6, "ja3_variants": [ "9eaa45a7b1d28166397037c5c8906372", "64a763dcb744c7664240a93eb247a906", "8524c1849936631ddc272577a33078d2", "bedf08aa8c934a6fce37ac0e70d80318", "dae14124dc08c49d68ec84fd5e1232f7", "0900f26221e51c659f36beffc04b0dbd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": true } }, { "hash": "t13d1515h2_8daaf6152771_f39212c3b29f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f39212c3b29f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-0-16-13-11-17613-5-65281-45-18-27-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789116596, "last_seen": 1789116596, "transport": "t", "ja3_hash": "b2c46b7afc44754326eca25b43ef5aff", "ja3_variant_count": 1, "ja3_variants": [ "b2c46b7afc44754326eca25b43ef5aff" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 34 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f4a97128a4a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f4a97128a4a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-45-43-23-65281-35-11-10-18-17613-65037-0-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788762055, "last_seen": 1788995416, "transport": "t", "ja3_hash": "64a7dae6ba8b63b9f3bf5acda096a32f", "ja3_variant_count": 4, "ja3_variants": [ "64a7dae6ba8b63b9f3bf5acda096a32f", "f8f5a2343d7e771f2524d3068b1b6bf5", "30b192c4b84071cdefdf88d4774669f3", "148f6910d3aeba22e16cf58631a4fb17" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 5 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f54af37c9939", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f54af37c9939", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-65281-43-16-11-27-0-17613-65037-23-13-5-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789516994, "last_seen": 1789516994, "transport": "t", "ja3_hash": "6314badadbfb7acda50cf172b1b7176c", "ja3_variant_count": 1, "ja3_variants": [ "6314badadbfb7acda50cf172b1b7176c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 34 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f5ea9f08be72", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f5ea9f08be72", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-49172-49171-157-156-53-47,0-5-10-11-16-17-23-35-13-43-45-50-51-65281-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788075562, "last_seen": 1789873491, "transport": "t", "ja3_hash": "b765f4534bce3740f769b0254478e9bd", "ja3_variant_count": 1, "ja3_variants": [ "b765f4534bce3740f769b0254478e9bd" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36": 34, "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.17 (KHTML, like Gecko) Chrome/11.0.654.0 Safari/534.17": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f92dce234eb4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f92dce234eb4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-35-5-13-0-11-17613-65037-10-43-18-45-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788784476, "last_seen": 1788788282, "transport": "t", "ja3_hash": "3c3416ec0042c43a5af3b80b7f124f83", "ja3_variant_count": 2, "ja3_variants": [ "3c3416ec0042c43a5af3b80b7f124f83", "d08ae359551651570c5b9690f9d28f93" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515ht_8daaf6152771_5563d4852cd1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515ht", "b": "8daaf6152771", "c": "5563d4852cd1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1479, "first_seen": 1787715189, "last_seen": 1789968370, "transport": "t", "ja3_hash": "b32309a26951912be7dba376398abc3b", "ja3_variant_count": 402, "ja3_variants": [ "b32309a26951912be7dba376398abc3b", "976ac777143e1d26968bf38df6551036", "51683eec9abc24cce3cb381ea0444ebe", "5548161a0c53da866dc2e4f2a165d29a", "e9188634d64c5a8b9cbb138ab3cb91e3", "42b96394f546afa0d33de76540067bbc", "dd99b08c608e455300b351bf030b04cc", "66c752ae30d5ee4976f3c95f64c2c6cf", "7b56b3d9aea0ba21dae6340e59735e16", "636362eae75129da9046343aa7b82a83", "bce25cd7da110b1e1825dd471e4236ac", "aff7af2bee24da9a6bc2a48d1c09cf4f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36": 179, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36": 182, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36": 198, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36": 186, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36": 178 }, "ua_disagreement": false } }, { "hash": "t13d1515ht_8daaf6152771_8c3e3d3218e6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515ht", "b": "8daaf6152771", "c": "8c3e3d3218e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-5-0-23-11-45-51-65037-43-35-16-18-27-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788846392, "last_seen": 1789036560, "transport": "t", "ja3_hash": "fb6225e500f61c6d0f4f1e43681e2d38", "ja3_variant_count": 11, "ja3_variants": [ "fb6225e500f61c6d0f4f1e43681e2d38", "1f801cd4288bc7947e1d283acbe12d4c", "6cfe930273a95a0c4f6361f40832a653", "574158aece476fe40dcd71194fe85e79", "285f388c2ec43e2c05880f2247f58414", "690208d72e3754ce6102f5c5c7b99828", "ca6951831d8e266ee540e1a0adf29c9c", "255ea335a43c7759adb0d67abc3d3968", "96757bdccda2f9a9d58428d3ba3f3cc9", "d74fa491ecd235dc9c8f0f76221cb3f2", "144258474c4be91197bd4d6e68d91ffe" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13d1515ht_8daaf6152771_f1525dfe0d74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515ht", "b": "8daaf6152771", "c": "f1525dfe0d74", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-16-43-65281-45-23-18-13-35-65037-10-51-5-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 897, "first_seen": 1788582212, "last_seen": 1789968480, "transport": "t", "ja3_hash": "233ecb340fc9d42865568847688158da", "ja3_variant_count": 896, "ja3_variants": [ "233ecb340fc9d42865568847688158da", "56d4c8791e4dbe004c09091fcfa46e0d", "4e98477afca4559bf22f5d8c3b615b45", "ddc3e745f316b10be4ad1add859e2ced", "88f1dd9b7577e3b1360b918eeef3a18b", "f9b68cefe14d59a6937b2521442a890a", "166bb2a979a77cb6657e10cf1eb5dc1c", "fa64dc5dd85b1521b35c7222a1d11340", "2b51e9d798feb0f1c065877fd4414145", "61a36bdac814bb1c3347b62e38923d88", "573c730154fe92ad175c368a6a5b60d3", "440d480e9504d7b8b4373cbbb69afe74" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 98, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 107, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 114, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 144, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 122, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 101, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 125, "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)": 1, "Mozilla/5.0 (Linux; Android 15; Pixel 9; Build/AP3A.240222.5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151600_8daaf6152771_e1bd3cb71b7f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151600", "b": "8daaf6152771", "c": "e1bd3cb71b7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-65037-13-43-4832-23-27-18-10-45-17613-11-65281-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788722673, "last_seen": 1788722673, "transport": "t", "ja3_hash": "4a70b4ef544ab282227489ca4e0fafcc", "ja3_variant_count": 1, "ja3_variants": [ "4a70b4ef544ab282227489ca4e0fafcc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_02e122b4eadb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "02e122b4eadb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-45-10-18-23-13-51-17613-0-27-65281-5-43-16-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 470, "first_seen": 1788441810, "last_seen": 1789922260, "transport": "t", "ja3_hash": "4b100c9b24a0645b553a805d69688700", "ja3_variant_count": 467, "ja3_variants": [ "4b100c9b24a0645b553a805d69688700", "f984bd5bc7358922cde86ed4471a2e89", "84fe5e66fb32fb1062ec4d911e1f3113", "4eac0a82f4b829a916cb826e66078e47", "73c41210fd4a1808ef5e78353d7a464d", "5a221683f6fa367b75c057ccdc7b1ce8", "bc2aec4ea44a0a677b80516bb7d86a3f", "aea63254b2f5292ea342b4b7722ee885", "957cfb02907b96c29a7cdd71ee8d9265", "ba5835fc10cb6923e97c5bd135502002", "b51ec83a87f71d0748285aedd7b81510", "a789246b30ebac31e129cb9febb9ce69" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 334, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 100, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 184, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 50, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 31, "RootEvidence/1.0": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 52, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 51, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1": 5, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 29, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36 OPR/101.0.0.0": 25, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 OPR/135.0.0.0": 10, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 157, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3297.78 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3713.110 Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.7.8 Mobile/15E148 Safari/604.1 Brave": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 AVG/151.0.0.0": 13, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 122, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 26, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 75, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.7922.34 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; ClaudeBot/1.0; +claudebot@anthropic.com)": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 2, "\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_0602f039c590", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "0602f039c590", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-65281-23-11-0-5-45-18-10-65037-16-17613-43-51-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 64, "first_seen": 1788442011, "last_seen": 1789964321, "transport": "t", "ja3_hash": "d8ab13e8ad7eb4256b44b74bb93f0d07", "ja3_variant_count": 64, "ja3_variants": [ "d8ab13e8ad7eb4256b44b74bb93f0d07", "6f15a0fd3fa1401fa1d388e4c8674ab6", "5002cd9c49290f7f2665a27287d21fe0", "7523455edb6e9b5618fa2357a476a465", "c8b077bedbfaf84eceeb838e08f87cce", "0d5865babc2b48115a3474757a115566", "3bd4f9e6571f8d6406bac45739db75f7", "491b687e3e29381d6c743f6843089056", "c3c7ab65ea2e63020b5933de19632635", "f9d32bd59df100d2ef726c0b780ecc58", "9817c125b20f0371e7c11ffc6fdb29b0", "8e089cb244b13ccb724a37261ef9255b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 53, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 35, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 270, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/152.0.7977.64 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 5, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_1_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/152.0.7977.64 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_0ec096184319", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "0ec096184319", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51764-11-27-5-16-65281-13-0-18-10-35-65037-17613-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788856460, "last_seen": 1789584042, "transport": "t", "ja3_hash": "967760f3270c989716507114c1c23c4e", "ja3_variant_count": 2, "ja3_variants": [ "967760f3270c989716507114c1c23c4e", "ab01556a08e3450ed4c2ce1acc8ad97f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_284cd94dc111", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "284cd94dc111", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-13-45-17613-23-5-65281-43-35-16-18-0-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 50, "first_seen": 1788442010, "last_seen": 1789964321, "transport": "t", "ja3_hash": "16b50e85d78ccce8752bf66e397225b2", "ja3_variant_count": 50, "ja3_variants": [ "16b50e85d78ccce8752bf66e397225b2", "ab5405c3fa2efb59d042554a076a5501", "7a2b3c3ca2bd562f050d9a7b3faa1894", "2afea2497727be3b0c37903928ad88de", "0b2dd6e0875391d0064354b8b99a7beb", "1652d71bc37a1ecfe6885b10998cb1cb", "dede8b1fbfda509fd5924bb3226fea02", "f6086c4945f350f90cddcad28fdbe0e1", "94147d9ef3ec02f8ba26d9e8475548da", "ad10918e708e0c80757b859d622f27fc", "6f9a920eb6183c7912e0f762294a7f66", "1fc695f2c70b1ada48b63c107f7cd43c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 121, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 98, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 87, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_2c66ae2d0ce4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "2c66ae2d0ce4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-43-23-16-27-13-10-51-35-17613-65281-0-5-65037-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 63, "first_seen": 1788455485, "last_seen": 1789949806, "transport": "t", "ja3_hash": "989fe4be5d7217db600b8866ae8833e7", "ja3_variant_count": 63, "ja3_variants": [ "989fe4be5d7217db600b8866ae8833e7", "3f86aa6ce89eab366a21c9c297f1947a", "f5ded4e0f4568c6ebef5371075764611", "15d115f32a2f91a95384a6b397d977fe", "384ea5ff72bbf0620a946ec153cf4d4f", "1f3f45f4e695da18a7fb0c083d1197c3", "58043aec9a1cbd6d9a12eedf20d0c831", "e40879393184d3a0558debb888224474", "2538d65aae41bceacc4e4717c24e7f3e", "560204651f15b8c9123fd0e1aebd049f", "1c8f10d8bd30ea5187e9057aac4f3b9a", "ca7273575ab8be5578a8927a99ebd43f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 138, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 89, "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 9 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_32da71d0a2c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "32da71d0a2c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-17613-16-45-5-65281-65037-23-27-10-0-43-11-35-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 62, "first_seen": 1788455478, "last_seen": 1789912221, "transport": "t", "ja3_hash": "9e318023a75e6bd73ac3b65378de4fd4", "ja3_variant_count": 62, "ja3_variants": [ "9e318023a75e6bd73ac3b65378de4fd4", "694eca2e6cd0ce6cc85f0ebe45bde2cc", "11c0492299d1a9c1a733db862bbe3e9f", "6811b3a9c291cfc377084bb9c9e26279", "e11ddf6f2fc0eb54934c7afa397c1cf4", "4bc4303f4bf87948518ed36662c3b159", "23bb13df999fa58df265cb591b362182", "90391343e5b7cac59a90e47048c0f3c7", "96fba8a1d00a0bd6b041b1c3d9b32a4b", "2e4a4e79cdc4c40c38604288244bd19b", "05425e75bc52e6990ca176e48ebffa90", "4bbb0ae44191f043bd52f3065b1ba95a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 147, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 402, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 5, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_494fa9cd0083", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "494fa9cd0083", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-45-28-27-65037-41,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1788288346, "last_seen": 1788768249, "transport": "t", "ja3_hash": "3826b2ac983301e19e6e089549bbde34", "ja3_variant_count": 1, "ja3_variants": [ "3826b2ac983301e19e6e089549bbde34" ], "user_agents": { "Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 2, "Mozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_4af6b3281435", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "4af6b3281435", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1788867264, "last_seen": 1789963106, "transport": "t", "ja3_hash": "598872011444709307b861ae817a4b60", "ja3_variant_count": 6, "ja3_variants": [ "598872011444709307b861ae817a4b60", "b44558ba4027cf4d864050c87a1611a2", "0c0950cd5a192a51599fb0fc2254240f", "8202e61fb01384e9af4f4b654ed7e519", "73a99fa877706ac9f4ed73adae7de1ad", "ffcf6570a05c5646fa742e721f68d399" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_4e18006c8ffd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "4e18006c8ffd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-5-17613-43-11-65281-45-18-51764-27-23-35-13-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788739407, "last_seen": 1788739407, "transport": "t", "ja3_hash": "5d4b505b870f817dfe7d9dc0f24f0b3c", "ja3_variant_count": 1, "ja3_variants": [ "5d4b505b870f817dfe7d9dc0f24f0b3c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_4e72810074ef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "4e72810074ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-18-16-43-13-11-5-0-51-45-65037-27-10-23-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 42, "first_seen": 1788442012, "last_seen": 1789952966, "transport": "t", "ja3_hash": "6590b88aca7f0b94c903fb7ba8f77ed3", "ja3_variant_count": 42, "ja3_variants": [ "6590b88aca7f0b94c903fb7ba8f77ed3", "772d2634524b35bd3c2a5904dba042fa", "ef954f6fae3fa2bec1dcc29a4a0d2ccf", "a7dfc602f28e53d8c7c4faefbc5ce368", "efb2e2fb3cfb0f53f063733d8eae8e2a", "1d6b6a041b138dfe9ec7cebdb660a437", "5c6ced6ec925f0ffe3cf6a01a1d1d1ea", "3c8269691caaa719382a52e63a771fa9", "fcf870f45ab9fe78102c159ebfd43360", "db50354269053b12e082321b974e748f", "e8c94e947b5d62fbd466dc6ffe6cda29", "bb4665c764082ecdadc4bc2f5506bc36" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 68, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 89, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 281, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 34, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_4fce3e8e6c1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "4fce3e8e6c1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-51-43-23-27-16-5-65281-0-35-10-65037-18-45-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 45, "first_seen": 1788455487, "last_seen": 1789832201, "transport": "t", "ja3_hash": "6485d8fc8a6f6cfd1452f157f6fe0d46", "ja3_variant_count": 45, "ja3_variants": [ "6485d8fc8a6f6cfd1452f157f6fe0d46", "5905009ee56295626f2d43b1152bb9a5", "ae2df3211d69e0214980b75fd800c7aa", "1833820636389121343a144bd04d24f9", "f8b950accbda7cf8b2f53d9677739ef4", "d6a80e27080dcca1f8d46f4c7a1607e4", "e84644ef501a16222753293cde7c08fd", "2fcd83c0c27c52048337fa2ff01edd84", "cba78a66b6a6f9bbfab51840b981832b", "e382f1a6b80e155ae8f3f64311bd65bd", "10607b2fff8abd28c47e49bb5002224f", "2c1f441d2aac37dc6c44c65757055eee" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 47, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 145, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 50, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_6697e4fcbfde", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "6697e4fcbfde", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-17613-10-16-18-65281-45-23-35-5-43-51764-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788723988, "last_seen": 1789576707, "transport": "t", "ja3_hash": "f338e476e09e52573ce17198f8bfaebb", "ja3_variant_count": 3, "ja3_variants": [ "f338e476e09e52573ce17198f8bfaebb", "50ce51154f639e6488cd9fa1684e8664", "e5995020f9feca6f8a322fa73ef18b8f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_6698f0c401b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "6698f0c401b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-16-0-27-5-43-65281-13-11-18-17613-23-35-65037-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 53, "first_seen": 1788442010, "last_seen": 1789912222, "transport": "t", "ja3_hash": "788fa16932aa71ce870465014e4180dc", "ja3_variant_count": 53, "ja3_variants": [ "788fa16932aa71ce870465014e4180dc", "fd1940ff14d82466363fe02b9a7e1801", "61f18a45568c8697e0cc3cb611175a36", "80d0fb7173d3506bb2c22b087dd041f9", "bfaf88b9beef68f7406ff94eca6ab279", "713b163d9b182d620076394b022bca97", "b1c4b56aac730d8abf7dca3ccdef8acc", "ba2b4b25240e19232c13eadb425cd656", "d322e1f74005655c2ec5906b85718cc4", "664b2097bba73c1df3146de08b4ed084", "b52cd0cf142ed6587992d148096a14d9", "a1fa7e3c09de27eeca6fc348be1c2edf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 68, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 142, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 60, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_73a26f977696", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "73a26f977696", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-16-5-65037-10-51764-27-43-23-35-13-0-17613-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789578325, "last_seen": 1789578325, "transport": "t", "ja3_hash": "bb15a5497506a151d1fd68c472dcb686", "ja3_variant_count": 1, "ja3_variants": [ "bb15a5497506a151d1fd68c472dcb686" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_769ac737886a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "769ac737886a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-65037-10-45-27-11-13-5-51-16-18-17613-43-65281-23,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 43, "first_seen": 1788487194, "last_seen": 1789929109, "transport": "t", "ja3_hash": "d28963a2117080ac5864a4187bade854", "ja3_variant_count": 43, "ja3_variants": [ "d28963a2117080ac5864a4187bade854", "b6a1dd5d29738004106e9baeed2d21a5", "9d33bd5def8f2b22bd8cf287ad373195", "b6a485972e903cfe9fcb564c32d75d0a", "4ed22f36c733aa693bd32e4636002f93", "b2c3d9af272d527b3c848b192d9b124f", "811f39c4d440f71e74a7463a39092810", "f29e8985bcb8624d579da0c9d844a3e5", "4728dda4e41ae4436f1aeb03ea76c7f3", "28e10f2789455c58a5e6ab7eda99928e", "72cd489ed6ebbfceeb51b201a76b6817", "34e026b6b58b6ba4ac3777fbed2ddbec" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 56, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 375, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 27 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_7b0b2a9ab28f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (7b0b2a9ab28f) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "7b0b2a9ab28f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-45-28-65037-41,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788958151, "last_seen": 1788958151, "transport": "t", "ja3_hash": "70bc8224f497e5e56b6b3aeeaa56d0f8", "ja3_variant_count": 1, "ja3_variants": [ "70bc8224f497e5e56b6b3aeeaa56d0f8" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1516h2_8daaf6152771_7cc2a71fb2f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "7cc2a71fb2f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-17613-0-35-5-10-65037-18-23-65281-16-27-51-13-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1788455491, "last_seen": 1789909632, "transport": "t", "ja3_hash": "0b4f2d7ea7dd4a9c851d408bdb9cfea0", "ja3_variant_count": 56, "ja3_variants": [ "0b4f2d7ea7dd4a9c851d408bdb9cfea0", "f421f15e6b7959c9666ad06134139126", "d2eb8616b2ff6fadd93bb70089927769", "82cf2c7db8ddcc561a9948a3b1b9e224", "aef76a094ef21a4bcc62170a5c9edc12", "c5e375a4017268ecbfe3a39959b2f7ab", "d1842bfbaef8c2933772eab7fea614c1", "f9a2bd5758a002f219fe0120b5f9b4d7", "ab7fdcef9fa219193a5042f762c39da5", "ab73283638e55a9dea4bbf8124227530", "6fa75806fef89ecb8f972435561bd2c0", "c2545e30ef3502584da03e85787aa57f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 52, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 121, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 51, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/153.0.8010.24 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_7e448db9ea6e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "7e448db9ea6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 38, "first_seen": 1787727406, "last_seen": 1789720078, "transport": "t", "ja3_hash": "a1d7243639bf3eccacd288639c620582", "ja3_variant_count": 1, "ja3_variants": [ "a1d7243639bf3eccacd288639c620582" ], "user_agents": { "Mozilla/5.0 (Android 15; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 4, "Mozilla/5.0 (Android 17; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 9, "Mozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 12 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_895d4bafc6d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "895d4bafc6d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-13-65037-43-51-45-0-10-23-11-27-35-16-18-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 62, "first_seen": 1788453621, "last_seen": 1789949806, "transport": "t", "ja3_hash": "e680fd2c65759a4391137dc15e82193c", "ja3_variant_count": 62, "ja3_variants": [ "e680fd2c65759a4391137dc15e82193c", "8aaf29445ae195f0e75ed7fc8381835f", "b03c15ae4e3939d9ba665ac410965f55", "b0808f20094a7d6ce381b382ddc85671", "2b1a00b5dfbf226f460a05d0b53f915b", "935d507191e34afcd28c4de181e2001a", "51f039cb589592d4e8c380eb40ada6eb", "81bb30671006e5dd5b5bed185bb274e1", "830828e0043b31e4c2bd7d6ac3d3137c", "d7c53ea73c1c81dbb5c8dea2fa0a8c77", "5efd8121ec83ddb1d6542094beda3cab", "5d3ea857ce4baad02574deb0e0309f02" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 351, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 26, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 216, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_8e37aa83b3bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "8e37aa83b3bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 96, "first_seen": 1787527277, "last_seen": 1789916106, "transport": "t", "ja3_hash": "e5e6f8c2d91420315471d8db1c9fe55d", "ja3_variant_count": 3, "ja3_variants": [ "e5e6f8c2d91420315471d8db1c9fe55d", "d4db205a0e09a5483ae292af1424960f", "dd333e8c5db515491bfa87b75be35fdd" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 34, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 204, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 3, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 71, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 175 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_8e5b76e5a467", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "8e5b76e5a467", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-27-23-51-16-0-43-18-35-10-5-65037-13-17613-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 53, "first_seen": 1788460073, "last_seen": 1789833848, "transport": "t", "ja3_hash": "9fb6282610afbcc6b151163b70a847fe", "ja3_variant_count": 53, "ja3_variants": [ "9fb6282610afbcc6b151163b70a847fe", "19263ac47bf77a80de8e74b9b518dbd1", "c7dc568b36e2c2f7463ef6d647b26d40", "7fe6b2aeb74e40ed70d61e570b683da1", "d58fba56f3cd440f08630ea0efca8aa7", "4faa79e0e05864b91456b5495e24953d", "7ddfdc99527946891c1565013f585c02", "877cddf9667b9ddc904edf7d5af6c996", "b079b0c8b529e427e496a12095079d04", "c8223b5992763ee5008d647808ba00f1", "a0b84f793334c2bbf902ffa44d3e5760", "1d12b108688e9883151833ae9602508f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 113, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 7, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_9fd9352597e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "9fd9352597e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-43-5-23-35-13-65281-16-65037-18-51-10-11-17513-27,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2279, "first_seen": 1787458461, "last_seen": 1789967858, "transport": "t", "ja3_hash": "1d9a054bac1eef41f30d370f9bbb2ad2", "ja3_variant_count": 2067, "ja3_variants": [ "1d9a054bac1eef41f30d370f9bbb2ad2", "64aff24dbef210f33880d4f62e1493dd", "a19ab9f02aacf42deddc1f2acb3d3f63", "66224fd5bec1ad2417b332a9380a453b", "3895d37c1c51bb0adf0f9646139c7830", "bab4282a9189c72b3c1d2b36fed0e6a2", "e1e245a183f58d168aded2dfd6c62291", "9fe5361d3601724488aeeba6e17ae6b3", "39b4fd1043ab93511e906b54aa67215f", "2d7cbfae7b7f1fb3019d13708a101419", "4676b2e32e6d420221a9ad3dcb18da3c", "9b64290b5f5bcfc5e1fb48b585ec4272" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 105, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 270, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 111, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 131, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 111, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 142, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.169 YaBrowser/24.7.8.169.00 SA/3 Safari/537.36": 55, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 106, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36": 54, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 23, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 129, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 97, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 129, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 22, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 43, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 7, "Go-http-client/2.0": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.6637.174 Safari/537.36": 5, "Mozilla/5.0 (X11; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0": 14, "Mozilla/5.0 (Linux; Android 10; SM-G981A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Mobile Safari/537.36 EdgA/80.0.361.48": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/": 14, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/124.0 Mobile/15E148 Safari/605.1.15": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 14, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.6248.48 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/532.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 40, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3074.89 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.2457.169 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3427.23 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36": 2, "quillbot.com": 18, "Mozilla/5.0 (Linux; arm_64; Android 15; 2505DRP06G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.94 YaBrowser/25.4.5.94.01 Safari/537.36": 15, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.6128.234 Safari/537.36": 5, "Mozilla/5.0 (Linux; Android 16; V2337A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.200 Mobile Safari/537.36 VivoBrowser/30.7.0.0": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3667.49 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.2884.170 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.2915.179 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 32, "pc": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.199 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.7778.110 YaBrowser/26.6.4.110.01 Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3326.95 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.2969.101 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.6077.142 Safari/537.36": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 Avast/142.0.0.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.261 YaBrowser/25.4.0.261.00 SA/3 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.7101.200 Safari/537.36": 6 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_a26a6bb28320", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "a26a6bb28320", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-16-35-27-17613-11-18-10-65281-23-5-65037-13-43-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 47, "first_seen": 1788442006, "last_seen": 1789916433, "transport": "t", "ja3_hash": "f1f795509e015af7e4bc0b0f684fb73d", "ja3_variant_count": 47, "ja3_variants": [ "f1f795509e015af7e4bc0b0f684fb73d", "430244931d67086a2aa172ffee8b23b5", "ac36501a68c25b7b61bc53940c86dcea", "616983aed06de5858c642997eb7ecf9b", "85d7be270a7ebebfba49d7285fca00dd", "06a63c692a68b8f123b578a1808cd35d", "64ca3e19a53d512facfb51910d588c15", "83f830dc348561e0b16df9863a8691f1", "eb9277e3e7b1e4033e11f25d0d8a6187", "794ef5bf97bbf92a5b23d0bd335390a0", "51eb06556fad0635f8571309601dd4b0", "fb57a88f57c6a563c9ed1582ac6cb04f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 234, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 187, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 85, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_a352db0a00b0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "a352db0a00b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-43-5-0-51764-65037-35-11-45-13-17613-65281-27-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788738602, "last_seen": 1788738602, "transport": "t", "ja3_hash": "893ba6c6d862cb542d9606ffa0845976", "ja3_variant_count": 1, "ja3_variants": [ "893ba6c6d862cb542d9606ffa0845976" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_a7826127fcf8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "a7826127fcf8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 936, "first_seen": 1787444161, "last_seen": 1789964431, "transport": "t", "ja3_hash": "cd08e31494f9531f560d64c695473da9", "ja3_variant_count": 47, "ja3_variants": [ "cd08e31494f9531f560d64c695473da9", "906e7b37ec933dfcc6ac2090d42357a3", "7ac2199503a2c47939c00e2837ed234f", "b6f6ee898ffa62993ccaccad5b5fbf4c", "646f55db3604aac0413f033356ac0fb5", "990447be30346b7227cfbd06945009df", "cc94315fe6889b1f99a4a416a66f3d89", "41a4f395864cd966341ca90d438f5ecd", "c23b0ae0593facb0caec65fe8c5772ed", "8dd50c43cf7fb24cfca617e1726c5a8d", "b142ab389ca8b29b53399488b9354f81", "a5c2e154c7e58d89aaf16c50e17e5927" ], "user_agents": { "Mozilla/5.0 (Linux; Android 11; Pixel 5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.53 Mobile Safari/537.36": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 23, "Go-http-client/2.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36": 14, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Mobile Safari/537.36 T7/6.3": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_b56d5ab84258", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "b56d5ab84258", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51-10-17613-45-16-11-0-27-18-23-65037-5-35-43-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 46, "first_seen": 1788452609, "last_seen": 1789940849, "transport": "t", "ja3_hash": "a1b37eec290ff5f10b34447dc2631f88", "ja3_variant_count": 46, "ja3_variants": [ "a1b37eec290ff5f10b34447dc2631f88", "e0a060c758882186884717391d2a0ef9", "6f7739818d7a68cd7bc09d82aca81cf0", "a9a8ebb7c1a3990f734cbeb459a6d553", "7552da136f93e5048d6524ef5f1401df", "dc708611b24e0d4df8e4645d3f12d67f", "f7e990ce476ea65e579dc8cc507273c0", "988d5340e0946d43eea260557efe280d", "aa2c81f3b62502ed0d1556674cb06297", "3a082bbd3fd3ef340d5ce590e4ecbc98", "8f2eeac18a9e6af539957e0c9d08657a", "29ead844b7d65ee26344dbe4f8a921b3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 35, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 84, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 194, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 58, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/153.0.8010.24 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/152.0.7977.64 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_ba9857c3d86d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "ba9857c3d86d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-0-23-35-13-5-10-16-18-51-45-43-27-17513-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788428281, "last_seen": 1789570265, "transport": "t", "ja3_hash": "9186fd35ff7abcf3642772aeb9b70c0c", "ja3_variant_count": 2, "ja3_variants": [ "9186fd35ff7abcf3642772aeb9b70c0c", "dd6d65e88aa332b6357fe2971ce06366" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_be8faeeb33c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "be8faeeb33c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51764-23-65037-10-45-13-18-43-16-0-27-5-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788459815, "last_seen": 1788459815, "transport": "t", "ja3_hash": "a3f7dd14bc52b8eb4db04bb746b964f2", "ja3_variant_count": 1, "ja3_variants": [ "a3f7dd14bc52b8eb4db04bb746b964f2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_cb37a4f7dd6b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "cb37a4f7dd6b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-17613-18-5-13-65037-51764-16-45-65281-0-11-43-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789214322, "last_seen": 1789214322, "transport": "t", "ja3_hash": "3da10bf4ad5f00c87124eb23884e4b39", "ja3_variant_count": 1, "ja3_variants": [ "3da10bf4ad5f00c87124eb23884e4b39" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_e25d9245df4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "e25d9245df4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-35-10-65281-65037-18-51-45-16-0-17613-27-13-23-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 58, "first_seen": 1788442011, "last_seen": 1789883822, "transport": "t", "ja3_hash": "1e421cfe1e3de9f7e951ba416d73d81b", "ja3_variant_count": 58, "ja3_variants": [ "1e421cfe1e3de9f7e951ba416d73d81b", "2248e9b3cb355e7b5c4ca767de38a167", "5cebec6513d2caf19a0daadf1d54fe1b", "e2a31e6f12117e2d6c7b3df75168cb82", "e7ef1c8d0740a4f05700c33d5eea7d0d", "97d8b6ea9681346c4a331ad2dd23d9cd", "71890563a3f1cdd0e4d2893d76c0d1a0", "9512e65db3ce2d955533186f582aaf18", "162eee71dd266652ba366e0968ba1f9a", "532fa6daaec8ca7d6ce9f27938c3b4f5", "cc310a250d0a75af18840142052cd389", "3f4a46a0c32f82f7069736deab7dd8d3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 141, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 111, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 89 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_e549116f6328", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "e549116f6328", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-18-10-17613-65281-23-5-27-45-16-13-65037-43-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1788442011, "last_seen": 1789940850, "transport": "t", "ja3_hash": "be6b6eca30cc0feedccce29639dbd1eb", "ja3_variant_count": 56, "ja3_variants": [ "be6b6eca30cc0feedccce29639dbd1eb", "6100a80efbda661b202d0e42634fd0c3", "f188590bbe33e5635f2fcd7246060ce7", "4c70a08749229f1da1b2e53bc95a3130", "e717e692573bf67bd791280676f4951e", "90e0d3e943831ec5fc0d19aba55c7790", "7feaf644cc49e4f932e303c9a079644d", "8435c2d67af2713e345d010719669974", "46c406e4fa99f441409282ddd3214b27", "5238383e966e7ac8709f7ee7cb2d224f", "9a1219c3d5a9da453271965005585098", "4eaae5d72ada19954002f2677696b8c9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 161, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 149, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_e655f92f5bb7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "e655f92f5bb7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-0-10-16-5-65281-45-23-17613-27-51764-35-65037-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789671198, "last_seen": 1789679051, "transport": "t", "ja3_hash": "b7c299928ce705f04d22ee8a562b4148", "ja3_variant_count": 2, "ja3_variants": [ "b7c299928ce705f04d22ee8a562b4148", "fc1cd0bc061364ef2ac5c0e2beec9154" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_eaa228a20f83", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "eaa228a20f83", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-51764-45-16-18-10-11-35-5-27-65281-65037-13-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788948724, "last_seen": 1788948724, "transport": "t", "ja3_hash": "7fddf475cb89bcc4a50af7e13fb92f8a", "ja3_variant_count": 1, "ja3_variants": [ "7fddf475cb89bcc4a50af7e13fb92f8a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_f135f22e6141", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "f135f22e6141", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-23-16-10-27-35-65037-51-17613-45-5-18-13-0-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 47, "first_seen": 1788487192, "last_seen": 1789869197, "transport": "t", "ja3_hash": "8a7ea47e53206ba0fc6381a3e881cd11", "ja3_variant_count": 47, "ja3_variants": [ "8a7ea47e53206ba0fc6381a3e881cd11", "9ac75eed4fbb0671c7db93b266cce53b", "6ee2c6994fabf77108b9d708b9ba8c3f", "08238088abed82fbbd819a9290498e77", "d49201253051d65d4363cf009552ad55", "e60bdc511cb53f85339380f06ed13469", "b955efdccb06072857987e4d121a83ea", "5d208fe5fb16f526f72d5477172a7d88", "42c5a67179e4793acbe43b50b97fd6c3", "d2c4a81242dd5cdce81804070257c54a", "043808dc45835e9daa6d5a983ba19e74", "ff1abe24dc0407319638cfc252f545cd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 66, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 29, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 62, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13d1516h3_8daaf6152771_db113fc12e09", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h3", "b": "8daaf6152771", "c": "db113fc12e09", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-17613-51-18-11-43-5-16-0-65037-27-10-45-23-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 18, "first_seen": 1787623437, "last_seen": 1789585570, "transport": "t", "ja3_hash": "74e530e488a43fddd78be75918be78c7", "ja3_variant_count": 1, "ja3_variants": [ "74e530e488a43fddd78be75918be78c7" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3358.64 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.2519.166 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3580.28 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1516ht_8daaf6152771_a26ff6e16f2a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516ht", "b": "8daaf6152771", "c": "a26ff6e16f2a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-35-11-45-0-13-51-65281-65037-5-16-23-27-18-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 157, "first_seen": 1788720220, "last_seen": 1789966732, "transport": "t", "ja3_hash": "931631bd09d318ae30771df772868014", "ja3_variant_count": 157, "ja3_variants": [ "931631bd09d318ae30771df772868014", "322ea3b117f3510cea4bff0c4240fa27", "48a0c7e5f4862b4f948f9a47f6590800", "bc1d57bfb5efee9d6e49e3ad1758ed0c", "fb2e751abb48308cbdc9d4a59e775921", "0b9ace429ac2c6305ca2aa7270c1b660", "e2ae4b75f7c8c7d9135fa02e23fb29d2", "9d639a7cf60d75b8ec8c1ea448e04301", "a54c3348ffb4a9321ddc83558af7ba9d", "5d3a164f150633946fab57fd28b34c5a", "2b0584c769896e06443e7b56c4b4959b", "e69eddc7b11187ca20daf2f680600fef" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 48, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 48, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 53 }, "ua_disagreement": false } }, { "hash": "t13d1516ht_8daaf6152771_db113fc12e09", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516ht", "b": "8daaf6152771", "c": "db113fc12e09", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-5-65037-16-45-51-27-17613-0-10-35-18-11-43-23,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 706, "first_seen": 1788441667, "last_seen": 1789954468, "transport": "t", "ja3_hash": "5e76c18b850fb67c92da5743669214f2", "ja3_variant_count": 706, "ja3_variants": [ "5e76c18b850fb67c92da5743669214f2", "88edb129c7702c2e5deaf4fd9fb98d3f", "411c5036f6ef856d51711cfb249f4c3d", "575cccbc85d1176c811a6cd6caccc18f", "ba32848e30c70b61df82514b3b771d39", "678c777e2f91c64dc3eac3918afc66e2", "88a9ff868fdebbbdb342cde2ea007877", "d31f7d66316f6118f3c8279fc58def8b", "9051d76ababac5db6f15e21ee493b321", "04430447998326ed124fb72c6b4c751a", "b0888fbc9d8be97074c80dd056a717e4", "ef54592d786c765a01f23bb315eb7537" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 237, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 34, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 470, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 100, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 191, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 30, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 58, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 newsai/1.0 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 141, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.7499.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.7632.6 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_022358f51d42", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "022358f51d42", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-4832-16-65281-10-0-23-43-5-35-17613-45-13-18-51-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 36, "first_seen": 1788481957, "last_seen": 1789754325, "transport": "t", "ja3_hash": "1f3bf0edbe1852bdbde43970df02c135", "ja3_variant_count": 36, "ja3_variants": [ "1f3bf0edbe1852bdbde43970df02c135", "a026c05a47602d77241503ab3d743531", "5d07b2c2d2ea802ec08070649cc65fee", "cb7b050f09ff5677cd871e32af389509", "7eb3033586e1c8091b3af6f9c6b6d784", "2e95e5ad878fc2f9539550f9e652c3c5", "0227346f78b8d2d6e260db278f1d04df", "d9078c835a14bddc3d459c2ca9f582da", "5591d636009b6d31673d2626d34fea1d", "e5329a42ea7199278f521f0aab2a9723", "bc27f3d91a61359856c590cce8764e0f", "3881800f8af5cd4aef5a521a4331b8fb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_04eccc9c959e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "04eccc9c959e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-10-11-13-0-16-65037-45-27-51-35-17613-65281-43-23-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1788511545, "last_seen": 1789947729, "transport": "t", "ja3_hash": "f1c6ebe546092cf8741173f737136735", "ja3_variant_count": 35, "ja3_variants": [ "f1c6ebe546092cf8741173f737136735", "f4d7382c1f767b6d18a69b1cf7518c52", "faea178ecfb5d976181e77e027feb298", "6bb7cde5d74b42e374c82b3c227bcd08", "192bc9feff5f62990759ead31c71b81d", "dac279a234607bc58186304e5591d992", "a336aeca7e0ffff710f4c16a9daa03a4", "e564d053218335dbdde7083736adde18", "4dd39371a12de2818d9c516b0518be35", "9872a2813a6c88e239e8a042de2e95e8", "6bc9489f1a65c5e3071c73552e825b3b", "c42e5e5bb387655f288e5c468a614d6e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 386, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 381, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_0509f9346a55", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "0509f9346a55", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-43-45-35-17613-10-4832-0-65037-65281-16-13-23-51-27-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789063958, "last_seen": 1789837279, "transport": "t", "ja3_hash": "ccf6d7f3375110f3a4914914cd786a40", "ja3_variant_count": 3, "ja3_variants": [ "ccf6d7f3375110f3a4914914cd786a40", "40ebd355bf846f341cb3322048d2d4b3", "36ab3fe99d0e300fee7ac271075aa2f6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_073be89ffb9e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "073be89ffb9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-65037-23-4832-16-27-11-18-43-17613-51-45-35-5-10-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788810977, "last_seen": 1788810977, "transport": "t", "ja3_hash": "ff4b53972b7f0cefe602517d81dfb509", "ja3_variant_count": 1, "ja3_variants": [ "ff4b53972b7f0cefe602517d81dfb509" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_1085e5058244", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "1085e5058244", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-0-23-45-43-11-16-17613-51-65281-10-27-18-51764-65037-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 78, "first_seen": 1788454349, "last_seen": 1789876383, "transport": "t", "ja3_hash": "5cf5545d7aa3ac61d9f753e614dd3ee1", "ja3_variant_count": 78, "ja3_variants": [ "5cf5545d7aa3ac61d9f753e614dd3ee1", "cacdb571f5f54178fbb3a0dbf177217d", "35925569b519160a2d65a057d7094c15", "843b25f64d1ad3b5e72ec3501f463abf", "fe3ab904b16c37b03e934d7c6c186eae", "76fc0c84f4519389bc4c91c807262425", "50ba1e518fe5860031ebd0594c861217", "ae8d6539b4b207141abad25528c4efc4", "c134b925191d8c76278c3099de6e46ba", "5b050417f7e0f8dd88dbb93f29d0e97b", "3488ffe9f2a19379caaac2a9f0eb8791", "c0af0259e5137b8af4d356095e77cdcc" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 62, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (compatible; Qwantbot/1.0; +https://help.qwant.com/bot/)": 31, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 68, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 61, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 21, "PromptingBot/1.0.0": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15": 27 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_10fccb135769", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "10fccb135769", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-27-11-65037-16-17613-35-23-45-51-5-65281-13-10-18-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 25, "first_seen": 1788455487, "last_seen": 1789955960, "transport": "t", "ja3_hash": "604d78f305abfd56a2ff9c8bc59454b4", "ja3_variant_count": 25, "ja3_variants": [ "604d78f305abfd56a2ff9c8bc59454b4", "1bb6bc3fe30ecd5efb9d0a29f8cc5323", "9de386efe3a61734edf6fcd1551c0224", "0807b334231948f39eb6b932a4365762", "6d237253379b663acef81d26629762e3", "5d75cf25816f81beebd6d59cf71dbe13", "bd2cfe09ac89d085ef3ccf4bef454d68", "12420c4eaa1ecfe153a5f8641bc0a669", "908587dc07fcf60e9814ef6ee44a7aed", "0d190946f9c6a0fd33dc50dcd333d7b3", "369b0062e583a2faed36a102f6431ae1", "8d2426c74ad34112916892099c3edc65" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 150, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 520 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_139a3ec9cd93", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "139a3ec9cd93", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-23-65037-18-0-65281-13-35-11-5-10-27-51-17613-16-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1788670107, "last_seen": 1789947929, "transport": "t", "ja3_hash": "e4eed662636a1b1b8033bf118b923f4b", "ja3_variant_count": 29, "ja3_variants": [ "e4eed662636a1b1b8033bf118b923f4b", "fb81247158cad54fdb8a395dc87f863f", "71ff756898fa7eda799b92900cccfdac", "8c0894437997859bd79af29a8600af2d", "35d94762ac98e63637d68e8a8f972621", "eee80c434b240214a07693ac27cd53a1", "53e689a95047fea3035ff01efb56ecbf", "86578f2c201c428bf2a461f8c92d3203", "2e682f14f9ba07aede6d0024f2865877", "91889b07c8b5ab5069adbc865dae014f", "81e4c9c402ce93e9a1e1a8f88d49b676", "f3a5bb14aac192581e598eaa85f201ff" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 103, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 258, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 25 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_14573bdbf458", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "14573bdbf458", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-13-51-18-16-17613-27-65281-5-35-0-10-23-11-65037-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1789337487, "last_seen": 1789952436, "transport": "t", "ja3_hash": "8c1846cfd394a3e0b58798f2f4f0c30e", "ja3_variant_count": 15, "ja3_variants": [ "8c1846cfd394a3e0b58798f2f4f0c30e", "1336c0f93dce2854251c59da136624ff", "c84943d3f1adf7c63391b30d593fec13", "54391e7614378e951b885420bfb4c16d", "511b33a69374292a2fcab9e2c97ff30f", "0fa57210fc632ad099be952e02dff723", "7dd87e544d36ff5f803a2512370c0012", "9a13a1981db466300da51e3fac150f3e", "2934a67e55bb52669f153504a491924e", "4ac2cfcca13f4c3c9fd031a8963b4b01", "cde1dfa4eae16792459fbe9ad4302cd4", "fcae3bdba3eb19f3b934b2564274950a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 152, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 301, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_187fd8edc401", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "187fd8edc401", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-16-18-65037-0-4832-17613-23-43-35-11-27-10-13-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789701010, "last_seen": 1789701010, "transport": "t", "ja3_hash": "7eae7864c6ced2d1a0c4325ecc6d53a2", "ja3_variant_count": 1, "ja3_variants": [ "7eae7864c6ced2d1a0c4325ecc6d53a2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_1d18168c06b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "1d18168c06b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-18-65281-0-11-51-43-45-23-13-10-5-17613-27-65037-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 30, "first_seen": 1788764483, "last_seen": 1789956321, "transport": "t", "ja3_hash": "f0089736bc3348599b0af1e669774134", "ja3_variant_count": 30, "ja3_variants": [ "f0089736bc3348599b0af1e669774134", "6385aed98e685aed62452549f5a8adb2", "b91924d83fdbaba063d4f48b41dfc7bc", "35c954b17e6263c08e6de14f0902d94f", "910b254b628c8230c359eecfac93ae6b", "884f73d9685a0be6ccc6de25bc055d70", "ea35be2cdda727298cc60849a056105f", "5c1235575c10aa7bfb161de96aed43a4", "9f04414e8ea306d77ee0b89a0583ad6c", "7e1b49f5e8553939cae40391e5fc23dd", "12d7f3bf3b9a4e39b597a2e66feacf0a", "93e9dcbdbf55a7b8426c04b896fdaab1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 310, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 348, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 295 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_1f5be7abbb88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "1f5be7abbb88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-17613-43-5-51-65037-10-23-11-16-35-27-0-13-18-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 24, "first_seen": 1788511542, "last_seen": 1789957175, "transport": "t", "ja3_hash": "a794d11679e6c21272914a1d54b07554", "ja3_variant_count": 24, "ja3_variants": [ "a794d11679e6c21272914a1d54b07554", "1810ac9300edad5b37075eeb2a74010d", "dfaf9b7c23ad9e5566aceb5a5463fe73", "6418c760d2f4cd1ce711da7ad111cb52", "1085a9e3b5450a03bec942474551449e", "5e4913819b3c2ccb54d8d261225d6f9c", "30c237a591e360eba94d16410e9ea54d", "b2768fb4e12ae32d605b1cd50d1a4a39", "1103ed61cbaa2a0ddc61e1559baad141", "ecb6a905d816ae1e218e18f72b63f017", "e81db86fda6e6677951ac63f69a92b01", "511844731dd597c1e08664e3d3266f9d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 165, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 196, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 28 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_1fda708985f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "1fda708985f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-51764-45-27-23-13-35-18-65281-43-16-17613-65037-11-5-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 69, "first_seen": 1788447441, "last_seen": 1789934604, "transport": "t", "ja3_hash": "a3491a87bc3fd89fe5c5237aed3f57a7", "ja3_variant_count": 69, "ja3_variants": [ "a3491a87bc3fd89fe5c5237aed3f57a7", "5a831bef00067808ec2c690d6db985a1", "0b20a8c2e55a1d72ff28c40d62b60322", "ca34d78efe7187e3aa82fc4a7af00d12", "6e619622570777e6d3d8e8aa9bf002eb", "e7e2c60efa8312d14bc72f920134b667", "4d82a36c90eea5f0e8eacbe37c690cb7", "ff01edc44819f54aac40c630f3581228", "70a76e7db50617b8e84a0eaedc8b1028", "ebb34ddf67600363aa582563f63a654e", "8fd85f147e5c836949e28a155dae7001", "7c338d0f93feac0222ad2ada921388ac" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 54, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 96, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 26, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 43, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 31, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 2 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_28e24ad211ed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "28e24ad211ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51764-45-5-17613-18-10-43-51-27-65281-23-16-65037-11-0-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 71, "first_seen": 1788508346, "last_seen": 1789820793, "transport": "t", "ja3_hash": "b8a2e5c076fa9168fdd8f80199756319", "ja3_variant_count": 71, "ja3_variants": [ "b8a2e5c076fa9168fdd8f80199756319", "676bc68ae03248389ae31bd88d6e527b", "d9fec8999dd63435120ae1cdf0f08da0", "dd4d5f32c56d3f6ba564df80d6755adb", "4b7630f83b9d6fe67514583ef0ac4773", "57ff7507f3aab63372285140fae597ff", "794f9eb9ffd19107e1068a72d989613a", "30ad973a9c35db1d422d3de4637db6f0", "6ce563a32df112d35edc00a8fb0039a5", "d60400cb8771e46f4f0f4c582d5cbb4a", "12c4149288710855ad63587693ca9a9a", "a3356d1f9266723dadf075e7c8780d7d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 65, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 29, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 30, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 95 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_2f8731a6a4b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "2f8731a6a4b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-5-17613-13-65281-16-43-0-51-65037-35-10-11-23-18-51764,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 59, "first_seen": 1788442957, "last_seen": 1789929111, "transport": "t", "ja3_hash": "208cf919bd734c0bf2833d8d86e075ff", "ja3_variant_count": 59, "ja3_variants": [ "208cf919bd734c0bf2833d8d86e075ff", "28bb5c1758a35b5c314025c465f88a30", "29f32917f740294192433eea39c2fdf6", "786cecf8578065b01b6149102ce03cc1", "cb5008739683b699299c313e27074442", "4884e737821f046f5af73c7c81e94e62", "727bf8dee592e4234c8babf6828add42", "db8fca309fb4101ccb037f8ff220c86b", "5a4d93b6f7c916bc89981279f9280f1f", "0247efacec7782844171ea35ba3b870f", "5e0ae40cf1b26468109f926c8fa4fb4f", "07193104c6a0ce929898c9b38b8901a2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 49, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 23, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 8, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 24, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 34, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 11, "PromptingBot/1.0.0": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_32e4bfa1f4af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "32e4bfa1f4af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-23-5-65281-43-45-11-16-10-51-27-65037-13-0-18-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788511548, "last_seen": 1789862257, "transport": "t", "ja3_hash": "e6b8387f6bf06edd3508994a55a3bcd3", "ja3_variant_count": 16, "ja3_variants": [ "e6b8387f6bf06edd3508994a55a3bcd3", "120e3940b7f9755838937320c822939a", "9cf9c5bf086544e95e63ca045d50ecb6", "4ed2720def31e55a42be8c28ce38d2cb", "9947716c75284f5e344f8a531067d117", "40dfe528d7b582a9888f60b5db135b12", "d29ee3ed608ebd7b5cfceb672cdbb8e4", "0055f583b8d340347b1c2506692fd781", "3f809b43c23876b0803abf153b633713", "af8c5dcc2ba0161b2e3736ee0b70ee7c", "41af9b78fa8dde6d3f46b0f9f3c8df22", "042b31a0050d33bdf86f92b80cb20a49" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 155, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 77, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_336658276580", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "336658276580", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-0-35-51764-65281-16-13-5-10-45-11-27-51-23-17613-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789028209, "last_seen": 1789028221, "transport": "t", "ja3_hash": "458b147b868e842955b34f58e3b14ac7", "ja3_variant_count": 5, "ja3_variants": [ "458b147b868e842955b34f58e3b14ac7", "925d7cf2ba77e80f3a507f03d1c48e64", "01fbeec8253e560deceffda9aabb7979", "89462f702e063f634ed3c0b8e46399b0", "4e7876685a837f6dc053446a0b6dcd32" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 83 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_4103a46087ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "4103a46087ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-43-18-51-13-27-16-35-0-11-5-23-45-17613-65037-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 37, "first_seen": 1788455492, "last_seen": 1789958180, "transport": "t", "ja3_hash": "1c5ff611c61c4b5de938b8e5f1b2d4b3", "ja3_variant_count": 37, "ja3_variants": [ "1c5ff611c61c4b5de938b8e5f1b2d4b3", "341791fcff7119a80f03630fa92e273e", "c572bcdf25de3b13eae82601c77747c0", "d8e69d8bb2af5bbc85722fa9e020e8ef", "43a682d2cf25c6a7ea4605b90c51cf2d", "bff261752f4458391410f22955415a57", "435b643d81f17e4846a3cb4e992ee5df", "c4d2af31d73364259d9637c4742308f7", "ec63ff93be9d3973fdbd3ee5be86914f", "b4dfc44af47e527de682251bccd3ba4a", "e9de4b18427c38300799c0f885ef59fd", "acbbea42fb148f9289d838b53d750639" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 614, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 387, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_4a49abb6c414", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "4a49abb6c414", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-65037-18-65281-16-5-27-13-43-35-10-51-0-23-11-45-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 19, "first_seen": 1788815821, "last_seen": 1789953720, "transport": "t", "ja3_hash": "df80657eb0b5632eeb4bf8f2e371b9de", "ja3_variant_count": 19, "ja3_variants": [ "df80657eb0b5632eeb4bf8f2e371b9de", "294dd147e7ba3f72c82e395ef7b4cd12", "36820f78bf72ef1830354939259d14f7", "1f28bd7364cc0a26b68315c613138c6a", "5eadccfb6df543a73e9b2589fbd47b3f", "c66308681cc66c8c3422a76c2c9d33b5", "d14c630c79579b55a78180ecc8d37b66", "79e269766f33a98c42ad6733055136ce", "42e74e55418d373cc9e2b6e1e015d322", "9f03f8796c3c141a528d75f807b1fcfd", "84515850ebc8cfc4cd310d9a1cd3c7f3", "e2b7ed85c9970a20a7e1cb9299a39d0a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_4aacc9508e76", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "4aacc9508e76", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-13-23-18-45-51-27-0-43-35-5-16-65037-65281-17613-51764,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 70, "first_seen": 1788508346, "last_seen": 1789876382, "transport": "t", "ja3_hash": "c2f0f0bd967bd96409e8aea0a28d70a3", "ja3_variant_count": 70, "ja3_variants": [ "c2f0f0bd967bd96409e8aea0a28d70a3", "d377c2e064f1fabe8714cba00d4b6700", "91070ad401d7102fbf98d4117f28fa1b", "ace1d1b75c668a5dc95d8f5557caea3e", "bf812ed28109ea952197745c8a3784bb", "ca05d06a0a7b860a1fcb257d03748751", "3e812aaf1e46aec5f09456239c987043", "c7fdf78d6ca41afd6751a2f4adefdf46", "a6f8c526b3d3499d905e9964e59cf688", "f6e699d3aa2459fcbf5cc19e237f6f43", "4718eb9f6d568b4367125ee2b9e2f8f2", "df83a5842ce239aa734cf1d23898931d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 25, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 49, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 95, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5, "PromptingBot/1.0.0": 23, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 9, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 2 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_4c8d7e2cb076", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "4c8d7e2cb076", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-23-51764-10-43-45-16-35-65281-17613-13-0-18-65037-5-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 68, "first_seen": 1788508374, "last_seen": 1789957554, "transport": "t", "ja3_hash": "b7449c61079075021d9811059d89c242", "ja3_variant_count": 68, "ja3_variants": [ "b7449c61079075021d9811059d89c242", "6e7dfef61a2683f4e4db9e29e5419344", "f3be8a052c4e76b879cbcbf35ac382a1", "bfd37507cc79efade12e18b5ed4f727d", "4cbd92e70d6e6a2d3b56e083294e27ac", "f1309e613906d0b400efb4a97bed705f", "3cdb24b4e4301658ca10ae041fe7f490", "9d5101c7fb8710a6aebef894210fc7e4", "12656b285aabf3f923e4baaa882def2b", "da86a2200fa926fbb72ee59b2b0fb6a2", "63c7e638a72bbf4adb56fb4877541514", "93c9d08c3b5b5f2bee87ae853311ae6e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 41, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 25, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 41, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 14, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_5a02ae809b14", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "5a02ae809b14", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51764-16-11-0-23-17613-43-5-65037-10-18-45-35-51-65281-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1788442956, "last_seen": 1789929110, "transport": "t", "ja3_hash": "32bdd2e811246ac09fec80918344d327", "ja3_variant_count": 56, "ja3_variants": [ "32bdd2e811246ac09fec80918344d327", "3d67b63890219f084983a13f5146dcf6", "fb735e48d97951c0b8b0af6313e64c7d", "ced9831578c20f413189f696582c19ee", "efdd875b064affb8f91d8cacc848ce6a", "1989c30e9287cad92f154117973ccedc", "5b39d75fae0caee5114e716b6e75e468", "c82e52e73daf605c5ec102e5e8cdf795", "e8525ee10718e35fc6d71e6bbc8bef2e", "44a8f3d5765523810176a21374a609bc", "281f59730089a9972b506a1da0c00d28", "2cb40db1ab0855084bd028f1c40c7c45" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 43, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 36, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_5b41ea1559b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "5b41ea1559b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-23-45-65037-51-43-27-65281-10-11-17613-5-16-18-0-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1788455481, "last_seen": 1789951514, "transport": "t", "ja3_hash": "1f70ee47e94bc87a29ff07f61d520f5e", "ja3_variant_count": 29, "ja3_variants": [ "1f70ee47e94bc87a29ff07f61d520f5e", "74a36e778495c157e20de9d5d97fc142", "d45b1861c54346be57c5756ea5c495d6", "6a035d38038babbd8ef886195c0e6768", "a87bd8aceae9a5d332b280c5a9711a89", "255d1269c59072eb9cc9b9cd226739d0", "4c9f39fec4c133a0d5fa421eb9d07e09", "87ad0aa8843223c7a2017affade9d782", "bb087bbbd41707e15d6507d2783f3e99", "a5166edafaf46d44c12cca782a68773a", "d6ebf78926c5f5ad60c5401839b145d6", "4eecf0fb9c45f71788d6cf39787beabc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 386, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 252, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 40 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_62332d89dbe4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "62332d89dbe4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-45-51-27-13-0-65037-43-10-11-16-65281-5-18-23-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 22, "first_seen": 1788778870, "last_seen": 1789951459, "transport": "t", "ja3_hash": "55f11a6bae7075ee1ad9b6057cf8ae9f", "ja3_variant_count": 22, "ja3_variants": [ "55f11a6bae7075ee1ad9b6057cf8ae9f", "3c04f7f2e984502e25b20204f38481c3", "950b587b6cf490e4e405db66b0ee8abc", "c5bc80a2e70f08d8d3a4635cc2613d5d", "5e6265a43d0a615345fd495afced5cf1", "fd812a1c5f285e24b67f0f1032f02a78", "1cba000f84eaf8f491974fc383550ff1", "123fc0d4518cb8758a33570de2141a8b", "f2d45ad0dfc21d2588d2b2b25c379214", "62657ab624581a30fa0772f95e037619", "94bfaaebf6d45f7fe856487c448002e1", "dca0b566f264993ba75cf022bcbb793b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 71, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 314, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 64 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_635d90b37c6a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "635d90b37c6a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-27-65281-43-0-18-51764-13-5-45-16-17613-35-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 68, "first_seen": 1788454349, "last_seen": 1789923856, "transport": "t", "ja3_hash": "122bacbb2bb648b65a52497280116c9b", "ja3_variant_count": 68, "ja3_variants": [ "122bacbb2bb648b65a52497280116c9b", "561c417e906de70f6563b6996c16c11e", "9816b3860edf8aa7f988640e959e5960", "6b817e4ba544550284d8c828e1f449a9", "3b78feee9341a80ae9dfc0f08dde6dc6", "f5eefc059688fdb79e88bd7911719e2d", "de440e9d8c71922a3797f0d5edb9691b", "38170757d5722b3cccea3ab0bcfee836", "1a21b618ee0931de9867ec35269b1063", "c25c2e9f39db8887c7de77719ac116d8", "2aa32bcf7f838f8cee2f8e9d3a03ea66", "121723eb420e1715543371b6b01fe7ba" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 61, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 29, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 29, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/144.0.7559.95 Mobile/15E148 Safari/604.1": 3 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_798f6b82d7e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "798f6b82d7e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-4832-65281-11-13-51-16-10-43-45-35-0-27-65037-5-23-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789386528, "last_seen": 1789946154, "transport": "t", "ja3_hash": "5f183df201b2f6f9288a2efe544724a5", "ja3_variant_count": 2, "ja3_variants": [ "5f183df201b2f6f9288a2efe544724a5", "bf4f851e499b73295c0c46914ad07982" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_7af0cb3b5dda", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "7af0cb3b5dda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 324, "first_seen": 1787485236, "last_seen": 1789889014, "transport": "t", "ja3_hash": "424f6d9c8b8928c0a0489a4f1a0f3e89", "ja3_variant_count": 3, "ja3_variants": [ "424f6d9c8b8928c0a0489a4f1a0f3e89", "9d42e90b0225e779f03141ddcd699df2", "a6500ee6b57fae757d8d0a14c31ed421" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 /157.0a1": 5, "Mozilla/5.0 (X11; Linux x86_64; rv:158.0) Gecko/20100101 /158.0a1": 12, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 /156.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 41, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 217, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 3, "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 27, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0": 32 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_7e6e16c20c5c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "7e6e16c20c5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-65281-10-45-16-0-11-65037-23-13-27-17513-5-35-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 414, "first_seen": 1788441555, "last_seen": 1789965252, "transport": "t", "ja3_hash": "66c8d006663d3cd49e10e0dc1b5bf833", "ja3_variant_count": 414, "ja3_variants": [ "66c8d006663d3cd49e10e0dc1b5bf833", "7240faaeb89da53a61a2781e611a369b", "9a250504703f38716355b60266952b0b", "314023f9633545962e67fc9f174c3683", "cdb0b971084aa69a9f366fa3888accdf", "ca6e4d4539aff050c9bceb874aaf6055", "a14e0c6eea258c2e24410b40846b8240", "a485a25f1ca20821e934187a48b44d16", "ec94d79f0175edcf3b11e18a5de12dd9", "fd40dd1b4dc4eb6047c835bab82862ee", "cef9c45c0f3a8b9e205399e49801a1b3", "500c78577059066797c591720c76094c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 37, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 26, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 51, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 41, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 36, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 29, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 38, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.169 YaBrowser/24.7.8.169.00 SA/3 Safari/537.36": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 40, "Mozilla/5.0 (X11; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0": 14, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.199 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.121 YaBrowser/26.8.2.121.00 Safari/537.36": 16, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1, "quillbot.com": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 16 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_7e8a14c5f0ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "7e8a14c5f0ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-65281-23-0-43-65037-17613-45-27-35-51-5-11-10-16-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1788442722, "last_seen": 1789960519, "transport": "t", "ja3_hash": "8601d7161c5ce6a0d580d93322a120a2", "ja3_variant_count": 29, "ja3_variants": [ "8601d7161c5ce6a0d580d93322a120a2", "7dc29c74534840e624ca5d74dd1694bb", "ea8ab84ab38d4c7c868bae722ffb5298", "bf6c0440911596317cc0decad1a66d9a", "3517e0fe6db268f83960ca42c03de1dd", "91897d3b34b320f670670a78a927a5f9", "15900bc55683fc8f4d7a95e120595bd3", "4f4247e0589d552c238ecef46d3f9b0b", "e08ac939d7d95d66d2acb735dfb216fc", "95debe5b90d213a0d22d16e0577db0e2", "d673b80a852f93283525a5e7411da2c1", "710e340b1aea6455ad7080ec184b5164" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 591, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 462, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_8033754817fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "8033754817fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-23-35-27-45-51-5-13-18-11-65281-16-0-10-65037-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1788649468, "last_seen": 1789930194, "transport": "t", "ja3_hash": "3b24435fe46df315832f35c2e8491c68", "ja3_variant_count": 35, "ja3_variants": [ "3b24435fe46df315832f35c2e8491c68", "4a0fffe72767bd25f7e6cc9659281a8b", "6935ffe6c83d86d554aeaf4bbb0a890d", "e3b180331cb379fee09fbd41227ea06e", "1f59ccd03c8244f5f00e5f319770839f", "8960b8bf7c81413beb5b74c6369a5329", "2f35b74a4fb5d40d3a1ce1a2803365d2", "c2e92bfcc31f18fd354c897913c1684b", "0d5c7a1e9989a219659f1d136da2ab94", "c9cdfbf0a0c54b70e9baed05ae1318b8", "ad0fc2cbe9f74b8db58dc89fff92ed72", "40f4f717d432134464e5a25401d3b583" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 899, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 424, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_91599cc177a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "91599cc177a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-13-10-65281-17613-43-27-18-16-65037-5-45-0-23-11-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 32, "first_seen": 1788511538, "last_seen": 1789945280, "transport": "t", "ja3_hash": "d87336262cba18de8e4dd8b9ad6347fc", "ja3_variant_count": 32, "ja3_variants": [ "d87336262cba18de8e4dd8b9ad6347fc", "1003e8eb0b1d59805c5214cda134ff8a", "94d5ea3db0d4854792fd01993fc2c9c2", "5abb8765f0e9a6d556dfd9bd1cc1bfb4", "d6f5debc1c4c5a3db820a25624282652", "3c34e91d2140c4e02c9d6a27bab53d1b", "f6f45c9a3a3ae6d7ccbcc03d7561a315", "f90a29d69ae49773cfda6d9c438bdb79", "70858f90ab6fce987238e9c3a10e3e21", "edc2ff385a92e062cd28a4a2bc70655e", "ca4b038f76918bb4fcf95711f1c7fb12", "51744d35d81d9d150833d11097a6de00" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 261, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 901, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_979d9b415b61", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "979d9b415b61", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-17613-65281-4832-45-10-43-27-65037-51-18-11-5-16-23-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788842715, "last_seen": 1788842715, "transport": "t", "ja3_hash": "a8a672f45796d5f98722a24c69ce7e96", "ja3_variant_count": 1, "ja3_variants": [ "a8a672f45796d5f98722a24c69ce7e96" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_98d29f222568", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "98d29f222568", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-45-28-27-65037-41,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 229, "first_seen": 1787527285, "last_seen": 1789490738, "transport": "t", "ja3_hash": "020ee54457b3c1d5f5a5050b22bee1f3", "ja3_variant_count": 2, "ja3_variants": [ "020ee54457b3c1d5f5a5050b22bee1f3", "a55f6cb044839f48d371a56323ed22ef" ], "user_agents": { "Mozilla/5.0 (Android 16; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 69, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 41, "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_9d19ce9ed155", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "9d19ce9ed155", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-35-65037-10-13-65281-45-17613-51764-43-0-18-23-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 58, "first_seen": 1788459863, "last_seen": 1789929114, "transport": "t", "ja3_hash": "4a216e4410d612ab0985d6f4fa96be23", "ja3_variant_count": 58, "ja3_variants": [ "4a216e4410d612ab0985d6f4fa96be23", "0c5cff962a3fb41ce45eb147427384aa", "409d597d3c46bef6e923e8e0e128d2b3", "0c700c5872dca386cabec116e5628601", "09f97a3ac2911bf832b6a28945105cb7", "8d8a6acb02a3ff38c2af6d821a46eb08", "32564d2ec00ed29ac44300a5a64997b2", "24ad4e7b94d168d0efea1b9d1e36ded2", "ddb886c9f9a291734ad0511a88fec932", "379d93f604132f9a562589bf7b4e9625", "be3a961034bb30e5f4c2f55564549897", "d88ff6a17654a5d6d3e49f52f9d67080" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 47, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 141, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 37, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 64, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 5, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 20, "PromptingBot/1.0.0": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_9ee06e8801fd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "9ee06e8801fd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-5-45-35-0-51764-17613-43-13-65037-51-10-18-27-16-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 60, "first_seen": 1788459863, "last_seen": 1789957553, "transport": "t", "ja3_hash": "ebb79ce7c8ad65c40dfdb4ecdcbdd33e", "ja3_variant_count": 60, "ja3_variants": [ "ebb79ce7c8ad65c40dfdb4ecdcbdd33e", "c639b02894546df2e26fb1ac5da8172d", "5403712270815f92103ac6c2b1b76db0", "f67212c558f386af06371a24499d9321", "27dc33f6b590d411e0a71f3919af5580", "4d5e92ce6b156baa7f8e4b780da948bb", "9797775c6dd85907c61e55ad8cd6eacd", "485a63ac6509408151973a6c71b5943a", "29c197d6f744bbb598a42559339223e3", "d81819e0a3f82edd191d94779e5f3e7e", "bb81de028fd1cfa53c0a2b9dc8531469", "89d8c7bdb901222ca5f5cd4e024d8b3c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 85, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 93, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 52, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_a816eaafa7a8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "a816eaafa7a8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-18-17613-65281-5-43-51-11-35-45-65037-13-10-0-23-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 206, "first_seen": 1788441668, "last_seen": 1789821075, "transport": "t", "ja3_hash": "fe5f1c70c6d319fbf0e704909b03a7dc", "ja3_variant_count": 206, "ja3_variants": [ "fe5f1c70c6d319fbf0e704909b03a7dc", "384d36d931dbf1064e9ac72a468eb812", "f12cf84a2f9a61c084b90b91b08533e0", "d93d755524c3ec38323bd07266a1d98c", "bbc82f255d5eba5ab55166a8846735da", "57c767e9f630369276e6e66dbe3cf702", "6daf8d3c09b0fc6482cd282ed5baf718", "39a56a44f0ca36099296ea2860f07454", "39c10f66ca7706505947ccbc46407f2c", "6bd7c8ca5755dc831623ea049765596e", "928e8a17023013eeece9f4357cb6584a", "46a8df6ef78694c6fc906559f5da8ff4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 599, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 26, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 3 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_af8a2721cac7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "af8a2721cac7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,4832-11-10-43-23-51-0-65037-45-65281-17613-5-35-13-27-18-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788810234, "last_seen": 1788810234, "transport": "t", "ja3_hash": "9c57eed87a2e6028481e6d5436220f72", "ja3_variant_count": 1, "ja3_variants": [ "9c57eed87a2e6028481e6d5436220f72" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_b3338fd442b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "b3338fd442b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-16-51-43-23-11-35-13-27-0-18-51764-45-65281-17613-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 57, "first_seen": 1788526293, "last_seen": 1789929111, "transport": "t", "ja3_hash": "02f257e379062aee26bd840019c16ca5", "ja3_variant_count": 57, "ja3_variants": [ "02f257e379062aee26bd840019c16ca5", "6de280d8e952180a6e440045dde59148", "23a1af7bfdd32bf1f246493e25955971", "2b2bb9996524eb0f1e168da7ef7f4a0c", "d4a7e69bbb1642beaa256db5a21ec303", "cbacd25748b220a72c7cf9e415f248e9", "64187695b67bb7f4c1a26dabf6bcb872", "ad0cc477bf45ac688e3b95d806b41310", "2d84020b3b8f105401a99cac86609e5a", "33cbab2d5acf6d909e1851cb03f1c756", "3c0f6f6e95161101f84ecd0f29552256", "d879e23576d03552b4257fefcbe11fec" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 73, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 25, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 55, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 22, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_b502b52a3b6f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "b502b52a3b6f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-13-16-51-35-18-23-65281-51764-5-0-11-10-27-65037-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 69, "first_seen": 1788459819, "last_seen": 1789934603, "transport": "t", "ja3_hash": "3fdcdc69650571c76ba277c51657229e", "ja3_variant_count": 69, "ja3_variants": [ "3fdcdc69650571c76ba277c51657229e", "fc2883be9810efc09ec6ff1b9a898936", "7a5a9706f977b764d9cf706b0c566887", "e0fff15330fc438822fc37e99293d751", "6d6bcc55d5567dcfda7c67d4c8c419b1", "40fbfe33af3b98bf4e194d32e2b5bbe2", "7ad7eb50b9c31293a18b7e1bdbaf5f67", "782f222ccec7d84c6ed52023b2696b86", "e754d45b6a1edde4d172cf5cac3202c2", "9613f454afcde7ef08b8531a2951ba17", "8473048979fa84b3adca86cb84553130", "ebb55daf326ae0528ca919ccf1412bd6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 109, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 31, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 117, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 17, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 40 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_b540d025f6c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "b540d025f6c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-17613-65281-10-27-35-5-23-43-13-18-11-65037-16-45-51764,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8222, "first_seen": 1788444359, "last_seen": 1789968348, "transport": "t", "ja3_hash": "2d25c56381929cc91bc97631a0a46f58", "ja3_variant_count": 8221, "ja3_variants": [ "2d25c56381929cc91bc97631a0a46f58", "b51449ac54caec528737183e0466a648", "43d52125f93a0a4205507f3f6e4865d9", "08fd8364fe565c0c45384db513945fdf", "bb6a35c7b54f227b94ee41bdc0489939", "43fdf9ca48a20054168a94f41e14a8d1", "d5a973a37c10e5707d74bc20004f0494", "c95aa1efae1bb1c815a23c88576ffa55", "4810e12fdd465c7e1ec6e81353ef2ec8", "c77c3efffbd35114463cdcfa5e05d0f0", "833c48863fc60e0f3e7364b2d2e9c497", "9b289f05ce6a729bd497716b25fe6e4c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5103, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 4194, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 4131, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5077, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 4756, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 4150, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 53, "Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 35, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 30, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.2730.35 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.5823.56 Safari/537.36 QIHU 360EE": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3530.119 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_c14ab140e455", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "c14ab140e455", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-10-65037-17613-11-18-51-45-5-65281-51764-43-27-23-13-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 65, "first_seen": 1788516138, "last_seen": 1789796844, "transport": "t", "ja3_hash": "84d88dc746c753b71ef905fe5e5e7749", "ja3_variant_count": 65, "ja3_variants": [ "84d88dc746c753b71ef905fe5e5e7749", "9cd20963353dd3cbac5f7c8fd4cf8875", "588a86d3de169486f307eed3bac691b2", "ebd4d2b78783003ea73ddd42a9900e22", "d335b1cae69bcebc5377bdf66d31c8c8", "37ffa4ce8b2c17f107c296d03b17d588", "e0c4c2f78070f28090c8b36257502c1b", "9bd49076ed0a7bb08d3355c646d7ea20", "e58c713414baec412e32ac6864d1740b", "79824cba809d98d611a02bb35473acdb", "5b15dc1b97c3828166a0d0e053ffab81", "a92525cfcaad76a738563eacdaa90d0e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 48, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 49, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/144.0.7559.95 Mobile/15E148 Safari/604.1": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (compatible; Qwantbot/1.0; +https://help.qwant.com/bot/)": 4 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_c3bfe41e2aa7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "c3bfe41e2aa7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-5-65281-16-51-13-35-18-45-23-10-11-17613-0-43-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 23, "first_seen": 1788806870, "last_seen": 1789941660, "transport": "t", "ja3_hash": "ca756b58ed03a33b3717d7e156613cc0", "ja3_variant_count": 23, "ja3_variants": [ "ca756b58ed03a33b3717d7e156613cc0", "76f21b8ef6b7d5cfe80bc61063494fd6", "25ec2bbe34bfdc442aa72495b4c46884", "739c29fb79246efd84e412df18e09d2b", "4d454ebb09fa47d2d4e1f61aa3a3ae68", "77b84a9316478f0d3997f7e8411576fe", "15afb076ca118a5f71b9a4d880c08656", "49fda7420ddf7eca5181d85ac41f0d30", "017f46a7c8a32c9414d4549051598c90", "bf55e494c64030e71a0fa1e3256b8029", "29dd8b96a3474bc9faf6e675ebf06328", "07b0a97b524fa549dfe2f0c8db46ce76" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 600, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 654, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 41 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_c80cf1d07396", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "c80cf1d07396", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-51-17613-18-65281-16-0-23-10-65037-13-27-45-11-5-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 38, "first_seen": 1788450036, "last_seen": 1789958021, "transport": "t", "ja3_hash": "f7665c9804556f11501c184b34c51406", "ja3_variant_count": 38, "ja3_variants": [ "f7665c9804556f11501c184b34c51406", "24bf3377decc5315e4dbe801e97c085c", "db79d4b91e6d6fdda9a4e43c87c472da", "2ca3347905200bbf3b69d1a57bb61521", "812f91e3afc46ebfeec93c4f2617dd1f", "f71d130c756bdf700b753054f6481aba", "d9c90b5afb77222176fa44edffa08dbd", "545660490926a5263c872832f77e89df", "9b94e78de7c1649f2b0a067a4abec608", "d29517a78b9fcccb1d08f861f81eed17", "b3829f5a0ab30f3db02e10985db70812", "404e173c3bf7f688a118013426872003" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 14, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 1, "Sogou web spider/4.0": 6, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_c92d569f1d01", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "c92d569f1d01", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-45-11-10-16-65281-5-13-18-0-23-43-27-51-35-17613-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 65, "first_seen": 1788459237, "last_seen": 1789935739, "transport": "t", "ja3_hash": "7750055a8cfc19a89931f65fcf8d6583", "ja3_variant_count": 65, "ja3_variants": [ "7750055a8cfc19a89931f65fcf8d6583", "68d8e803514afe068ade2cde421b0b33", "54af34cd4de947de3d8639d0a029fb16", "5c0817d30ddadf7b07a83b6c6da0170f", "8e6622f21e811d18427cdd4c333b8b02", "fb7daad210847e94c0bac2556d1dd8de", "ef3e165438de4898da2d5657f843a7c7", "46f4160311e3c91d7f483f5d81cfefd4", "333f31f8b394d959819ce2ab0921bf89", "acaf0bbc907298a95f9fcb4cf95a11d2", "c2972e918aa7a02a35d64ccfb3690c0a", "4a6b2265d95178356e0e4b8591fc4fd8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 49, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 44, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "PromptingBot/1.0.0": 26, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 55 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_d0c3baafe37d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "d0c3baafe37d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-51764-65281-35-45-51-10-13-65037-11-23-18-43-17613-27-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 67, "first_seen": 1788508349, "last_seen": 1789912454, "transport": "t", "ja3_hash": "970df818b56a9e59978ad33b3f2d20ed", "ja3_variant_count": 67, "ja3_variants": [ "970df818b56a9e59978ad33b3f2d20ed", "5f5c99421892962959fa0e0a8dd672e0", "a7ee8421aa57700977198a82133e8ebf", "c27f18982c66144f24c431de4a6be4ab", "e22a2bd8a526920410b8ad4279d0282c", "680db103fdc936515de1261b9faff18d", "84b880e535fcaed670db1716c89c8fe8", "542c99f7342a1b10fad1e272864cec15", "a160b46783bcdff17d902afa6e9e9e4a", "3c3e9a86ea5e55255def247dc7472574", "5db54719a5524554fc37e5e7d6505b39", "29f2f8b717da375b14a0e74e248a9a3a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 37, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 76, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 4, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 3, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/144.0.7559.95 Mobile/15E148 Safari/604.1": 23, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 7 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_dd9efda7f7b0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "dd9efda7f7b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-10-17613-5-65281-13-0-18-11-43-35-27-45-51-16-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 32, "first_seen": 1788458539, "last_seen": 1789945919, "transport": "t", "ja3_hash": "d59b00a7919abb33f82b1d94f1bcff8e", "ja3_variant_count": 32, "ja3_variants": [ "d59b00a7919abb33f82b1d94f1bcff8e", "6c0c78b0766b692e1e60ce1026694bfe", "b1243b33313cce7a9f5c6710a90bfd66", "70191b56d4be723e15933f5d9a30ba52", "85ad20021a6048e77ec735f8bda7f63d", "2db915e176e34e48ca11393fa48add7e", "4b3da80b0fe63ca4f742bb3242840d1c", "e20873eba0ebec5669270bd6cf42e8ad", "17bb00d6a746219e1a16d8b67dbd3b7a", "8376e15258713915c5515ecf110aa8c8", "3d1f650dd2359315804ec3544f33078b", "cd42416ced22263743363974d206c9c7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 335, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 100, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_deb8da781666", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "deb8da781666", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-65281-51-17613-13-18-51764-43-5-27-16-35-10-65037-11-23,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 55, "first_seen": 1788459234, "last_seen": 1789958117, "transport": "t", "ja3_hash": "e6002c29e0189f759cdab1af2d5238e7", "ja3_variant_count": 55, "ja3_variants": [ "e6002c29e0189f759cdab1af2d5238e7", "bb6d0bffd8f8fd7d7c707478b60a1469", "bab69a4156ceed935262e58e15dbdb37", "62dd1d0484f96f8697ec656291e9b6fc", "fc41e73bed52a5a0de16539fa4ade7de", "2fcbde8c06eb15150f1a60c343905192", "edf52a7206e48269dc7efe7d75c00947", "92a77593dd98b4bf0dfd847e5c65eaef", "239488f04c1725db7fb99b9ba541f98a", "4b4f786916219ca5605a4cc4c58e9813", "56e5077d3d2d007604cf5cd9910e05bc", "b22581b4207ac01152db4ad90d09d954" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 115, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 40, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 82, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_e1e0c1594192", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "e1e0c1594192", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-13-18-35-10-23-17613-27-43-51-5-11-65281-65037-45-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 31, "first_seen": 1788911728, "last_seen": 1789957514, "transport": "t", "ja3_hash": "ab6af7677e9a218e3db5d914b1243255", "ja3_variant_count": 31, "ja3_variants": [ "ab6af7677e9a218e3db5d914b1243255", "6e48ba418ee65ae6cdfe3155d4312acc", "74b329bbb6d8274795781db27ca6dbc5", "4f493562ca9a910ee2b0e9930c551077", "aa02fe829c5e755999c0e5f03ba0ac48", "8f2029ca523e5ddf1d5266cf918f2855", "c95e12e4c70276fb4c8ad83b2d1b6cf0", "198999d258852cc17e68941d080cc5d3", "c64aac48c0792b23d6cbd6039b37d68b", "d8986711d215249da57bcba6f2dbe761", "827138116cf29694c86870167a4f222b", "48c1eb483d7a9aad8bd1e5b2390af668" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 762, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 321, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 516 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_ff54581d4608", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "ff54581d4608", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-17613-51-13-43-10-18-23-65037-16-27-45-11-35-4832-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788810183, "last_seen": 1788810183, "transport": "t", "ja3_hash": "d83405a8617ba384caf1799560b433a7", "ja3_variant_count": 1, "ja3_variants": [ "d83405a8617ba384caf1799560b433a7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517ht_8daaf6152771_c80cf1d07396", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517ht", "b": "8daaf6152771", "c": "c80cf1d07396", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-51-16-35-0-65281-10-23-13-5-11-18-17613-27-43-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 394, "first_seen": 1788444045, "last_seen": 1789098846, "transport": "t", "ja3_hash": "5c93b007a94d59cbcaac8d76214f2ecb", "ja3_variant_count": 394, "ja3_variants": [ "5c93b007a94d59cbcaac8d76214f2ecb", "be24fd6e48f03bdf007edfc8fd6f3cde", "b41da4a965b9d02606754d8a85877764", "361d76137ab001ad645a44b1796218d7", "1063d9e147e192d4fbafa064f08db7d7", "7c9458724daffdf2292646ad06b3834b", "ac1f2ff1925276883b5376ec31b6a3cc", "72ded7d8663c367890d87510316fb3dc", "c0701f8149a894d96d5699c3f0f45896", "d04474c130dc94bda6f9745c48e7a791", "ee530642a4b54a6a894e2d08ce5f6415", "4432b45447acc2c53e79fefb1401a58b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 124, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 56, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 newsai/1.0 Safari/537.36": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 89, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 25, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 192, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 44, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_16591a004eb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "16591a004eb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-17613-13-16-65037-0-35-18-51-51764-23-10-65281-11-5-43-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788560001, "last_seen": 1789653311, "transport": "t", "ja3_hash": "5ad6bbca825cc2957250ab1dfc4b89ce", "ja3_variant_count": 11, "ja3_variants": [ "5ad6bbca825cc2957250ab1dfc4b89ce", "2ecc8e8591693ab4993c5286f521f5d3", "8fb196aa65ceea837a452ef90e074ec2", "e5ebad8ab5626c713880e97ad150ad92", "3078f1a11da407456a82a9256312a04c", "1ac37a6896553c9c1bb8023022b8806a", "71dca947af5ef216b63348359c80060d", "004e9b23988a0f8adfbde48fdb438808", "a85701d35e068b870ba6faed3704e84a", "314119d2364a6134299e029edc72e57a", "44fb27a7f23e4448d118541608d84f7a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 63, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 41, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_18b64242ae5f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "18b64242ae5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-23-11-13-17613-43-27-51-35-16-10-5-65037-51764-45-65281-4832,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788842716, "last_seen": 1789587738, "transport": "t", "ja3_hash": "1c9c5f11bb62c5eb7f04791bee18cd80", "ja3_variant_count": 10, "ja3_variants": [ "1c9c5f11bb62c5eb7f04791bee18cd80", "3148f8bb212258a62e04fc1e4bc861b9", "152ec46d561cae06f4c11632b24249cd", "5d11b1ca53b3dfc09dd4c93960f0e284", "f6b322ae1c4ab7a5987d0669a6dda8df", "2e4076d294376bc053801c14ac014645", "09584398e3a534f9ea731849558f4122", "93e561230a02188d9c4ec1f1bc4f20af", "9fbcdd00596d7beabef91e5d562ab70b", "f4f9da92420c308713077b7ffd6605aa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 8, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 35 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_20e599e072a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "20e599e072a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-23-10-65281-13-5-43-0-65037-51764-35-18-16-17613-11-27-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788508430, "last_seen": 1789658370, "transport": "t", "ja3_hash": "8b179d957556a8e8bf5691eeab08c74d", "ja3_variant_count": 8, "ja3_variants": [ "8b179d957556a8e8bf5691eeab08c74d", "8c8fcedf99e5474d41ed842a246c9533", "c4566d68b5ac8ee1d4961fb24928c9bb", "434c2a682ab41f83bd4b9ff6370d64e8", "a30cb766d441ef9412c8ebbf2a1487de", "8cb9c1ee860a28683856e87690e15dad", "9cfee5c871e6718050f52b8885ab1b74", "aff52e948024bb238a28466b63ac67a9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 29, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_353ed13deaf5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "353ed13deaf5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-16-0-10-13-18-23-5-65281-65037-51764-4832-51-35-11-27-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788681330, "last_seen": 1789701023, "transport": "t", "ja3_hash": "258d9d8e83dce2cd14dca857cc5221f5", "ja3_variant_count": 6, "ja3_variants": [ "258d9d8e83dce2cd14dca857cc5221f5", "b8d337e61b83797f01e809be0dcf6c5a", "2c38e38be4d8879cd4326605fd57315e", "48ca0545716df8bd9235dafcef7ff90b", "1c647d82a567123900fd6aa66ab9a435", "0f66221c199f05e4ead129707e50f96c" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_3c770798d5f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "3c770798d5f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-0-65281-5-4832-35-27-45-13-51764-65037-16-51-18-10-43-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788653265, "last_seen": 1789375022, "transport": "t", "ja3_hash": "bf1972e30d4953d26b8b0163ca7c7826", "ja3_variant_count": 5, "ja3_variants": [ "bf1972e30d4953d26b8b0163ca7c7826", "54ccb47ca5fcf71223b0f78ea9ac0112", "917de3e31c90ede057b1d875d75351c1", "8aceacc5f62776dc12438fe4a611993b", "14037dc724630a571c4e52e185f44f00" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 25, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_3fa279c3c235", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "3fa279c3c235", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-23-65037-17613-10-0-35-43-16-5-27-51-18-45-51764-13-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788508421, "last_seen": 1789669090, "transport": "t", "ja3_hash": "933059d8dd33955b47b9fc3801eb0dad", "ja3_variant_count": 5, "ja3_variants": [ "933059d8dd33955b47b9fc3801eb0dad", "b016f06dab471521b30be71e839b84c2", "96d9a9074192163e67647b91b5a18b1e", "3871f3a9463274590a07fddf43e406f6", "1663acd3280c06ba7ac9639192d87e1c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 98, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_4142db4e03a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "4142db4e03a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-4832-43-65281-0-16-11-51764-45-23-13-18-17613-35-65037-10-51-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788810243, "last_seen": 1789012138, "transport": "t", "ja3_hash": "4481ee64687ae47e3a4369eb27360a48", "ja3_variant_count": 4, "ja3_variants": [ "4481ee64687ae47e3a4369eb27360a48", "95e76af1ccce049b3712978a1c63eefd", "dea4a62c6e02758bc13d844a250c93d4", "cb1807fdcd33053bb04c2f0668fa4b22" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 34 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_541d4068e22f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "541d4068e22f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-27-51764-23-51-35-18-65281-11-5-10-43-65037-13-45-16-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788550324, "last_seen": 1789657893, "transport": "t", "ja3_hash": "7aad8bb7a557981daf7f79c5c716396b", "ja3_variant_count": 11, "ja3_variants": [ "7aad8bb7a557981daf7f79c5c716396b", "33d8bb613f414312a9200c661583d7d3", "96348818aa04dc792312d8c4cfd91311", "1d9559e754f9d92d500a9df39ccf5dde", "12ca74b8d2d92f2112b9ade03e77f568", "fa7ea8b430f4b0354b65dbe6f324babf", "53726982a443685c7da194a18d18a29c", "4b60fa6a424f844250672928d38d86f6", "7018661f293038ce3c90103c36f82faf", "91e00d45d219baa88b64c34d6358279b", "91a88769bc9bd3da1c3013c28a6503e6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 25, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_5568d14ab310", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "5568d14ab310", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-65281-4832-17613-16-27-35-0-18-51764-51-23-10-11-65037-43-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788885582, "last_seen": 1788928486, "transport": "t", "ja3_hash": "425775da70c492d5c3eb5903ab180d76", "ja3_variant_count": 2, "ja3_variants": [ "425775da70c492d5c3eb5903ab180d76", "cf12298ea25972e042340a684f871de2" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_5acfb5ee7fe3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "5acfb5ee7fe3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-51-18-51764-11-45-27-0-13-16-65037-43-5-65281-35-17613-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788459867, "last_seen": 1789740340, "transport": "t", "ja3_hash": "6acc3e35dcfc31e758a14867dce27b21", "ja3_variant_count": 11, "ja3_variants": [ "6acc3e35dcfc31e758a14867dce27b21", "728ed5689b6632a6f9889a6c42e46ba9", "a8365dba117ce7ba2dfe338b8c182498", "7c377d55f88793b484ed85c8559c6fca", "023473452229925be3d44f87929bf7e0", "321ee81cfc669a0f9fab29a9b5037c25", "940104cd3bee9825f17102b2b17fb7a7", "b92e3954ac7725040d77794fa0338eb8", "d5093a9e058fbc20bffaea82c10758f0", "a2e926f0b3c70f7b95cadd0367c8658e", "b15cbcbf4e5f86cf8b4e7f8b136f419e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 86, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_5b1e49e67150", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "5b1e49e67150", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,4832-10-17613-51764-35-5-51-23-45-43-11-0-65281-27-18-65037-16-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788681332, "last_seen": 1789701017, "transport": "t", "ja3_hash": "8598725cab8754280b55352c545cbc25", "ja3_variant_count": 5, "ja3_variants": [ "8598725cab8754280b55352c545cbc25", "525a0eef46765a0bc4cd4ba8d07ae144", "1e2c57a7d9f43ddb8bb0838b95eb58d5", "0041999367f3084a4142f37ecc4a60d4", "c2aab191f45c58ed7d30f4e6d7bf9724" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_5d320455916e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "5d320455916e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-35-5-43-18-65037-65281-45-17613-27-11-16-23-51764-13-51-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788505880, "last_seen": 1789658279, "transport": "t", "ja3_hash": "b48f0296071aab8513aba13d5fcfa212", "ja3_variant_count": 16, "ja3_variants": [ "b48f0296071aab8513aba13d5fcfa212", "8d277f4597c3b952c31e52bce7bd8890", "0ac43d4707f8e8016ee3f29647dc0760", "05a60d15fe505d3d52d6eb04e0fb2cea", "f8aaef4f258650fa29f96a5fb62ce590", "cbdbad87d0b2525ba2916dfd66334172", "9624bf8cff64b207bc7668e5ef3c9eac", "2c787c257a77616a0632cb4adec6bcae", "292a343b40fd100a86fba06caf922dd1", "b8f149e6e48080b4b09d6ab4fc7b42f7", "9fba92f9782aeccd4619ac4701aa4cea", "251ce56deaae0d1204d82547ab5813ff" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 29, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_636efb5f59e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "636efb5f59e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-5-17613-4832-18-16-10-35-65281-13-11-51764-43-0-27-45-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788810232, "last_seen": 1789701023, "transport": "t", "ja3_hash": "e2ab05873b7e88c17b5953b73098ebed", "ja3_variant_count": 5, "ja3_variants": [ "e2ab05873b7e88c17b5953b73098ebed", "fc2e52b58138b2d70b1e72c055c501ca", "11cb293871582f64eb36255e94baf861", "5b66a9cfe4182d3a4c18511c4dfdb562", "f02c6fd272c7d3f18c09e33bb586b32f" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 35, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_6c9755ee8c21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "6c9755ee8c21", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-51-4832-65037-65281-13-23-35-18-11-10-17613-43-0-27-5-16-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788681329, "last_seen": 1789012139, "transport": "t", "ja3_hash": "542d6f5eef416fbb9f614b2f14e376a8", "ja3_variant_count": 5, "ja3_variants": [ "542d6f5eef416fbb9f614b2f14e376a8", "a89091d9703db5e5b2b71318d4e09696", "551216b844b79733b4e7d3b568dbd0ae", "18be4be78f190243cfa673dfeb39f286", "8116c5000f1c62be738ff7e8c588f995" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_7475c8b4a612", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "7475c8b4a612", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-16-11-18-51764-0-51-65281-5-17613-35-45-13-27-65037-23-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1788556625, "last_seen": 1789651512, "transport": "t", "ja3_hash": "397f259c4b75a9fb6ae100055bcb3813", "ja3_variant_count": 14, "ja3_variants": [ "397f259c4b75a9fb6ae100055bcb3813", "1299616acaefbf7c4e9b6b628bb6021e", "b71ff193a135588f8e5cfde0345f12b6", "c6bad3ab411de1a4171dcbbdc574bd19", "d084e71bd8afdf2e0e7db7c3991b1f2e", "45955356708360a4e41df68bfcf393fc", "7c43f88a73feaab10285603c8f87e38a", "fbc78dc163a16e36c7cd96bf28f6cff6", "1ad0d4f919bd8e33a29ff5fda61cdbe0", "8dbc36bd45fdef05a2f5af32f05a3e5d", "b9b94fd46a6e10118d2b014bbe4f3ddb", "911d1204e06b441a8ecf08d794e43154" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 216, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 90, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_85db8068b50c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "85db8068b50c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-5-10-17613-13-18-11-23-43-65037-35-65281-51764-16-45-27-41,514-4588-24-23-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1788550304, "last_seen": 1789923909, "transport": "t", "ja3_hash": "a4f7e7ba6db99995f9e9eb0811e73df9", "ja3_variant_count": 12, "ja3_variants": [ "a4f7e7ba6db99995f9e9eb0811e73df9", "dc1288f3f341a797f050e25af00385c3", "d5158b326ac3dfaa6b1cca2737fb4454", "efa45627423f2f373f7ded7e47f2469a", "2b3cc184c2385120fbe065082b9b7d6a", "8f10286ac671c79e18eeef7a482b65f6", "832705cf0691c1d46b56c0ca5314274c", "1a06f4d8a66fb954f3b5ed99d2d78ab3", "4e0840bf1ce5807c16a06572c3028b87", "821b7fdf09318207d80322fbf7bd5d48", "711693d5f3c6c7a1f62399f0b3a06e77", "70389c2e45ffd4c33378639196024ba2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 144, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 34, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1518h2_8daaf6152771_8725fc830744", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "8725fc830744", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-23-43-65281-5-0-17613-65037-51-18-27-16-51764-11-13-10-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1788459871, "last_seen": 1789935740, "transport": "t", "ja3_hash": "0473c68087445b08869fc9865f4c16d8", "ja3_variant_count": 12, "ja3_variants": [ "0473c68087445b08869fc9865f4c16d8", "e9cd59f357e24750ffa31efc54b09267", "778df88435cf4dc66e0ccdd92716039a", "905f94391ac98a96eeae339d5564547b", "f1d4e2ceb1409362fe4f530eb186cc65", "520e4afed3bc5c19804df2b342fd1bb8", "7e846893585da7bd518ee1c941fcb9a4", "4ec9b8506f9fe94079c3451d43dfc3dd", "02434a7927e8ce31f79b0a0626da4df4", "90a5828b093db1c374549425b5120ca4", "f89bf679c8f808298c45ee9254576e85", "53141945a452685307cec7eddbca20eb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 137, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 29, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_8b83ee4b167c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "8b83ee4b167c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-27-43-65281-4832-65037-0-51-23-35-18-13-10-11-45-17613-51764,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788681330, "last_seen": 1789701013, "transport": "t", "ja3_hash": "f454be1620a02218cd6e2acc23767085", "ja3_variant_count": 5, "ja3_variants": [ "f454be1620a02218cd6e2acc23767085", "f75b014dd264fe7ff7ef1d0f242007e6", "5c0345bc569926a9a41895302ffe4c4e", "123b5c19f312c9b50d40881d7a2c2b2a", "58dfe4823a07c6fcf7b6cdbd7500a374" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_8cebf4ce2327", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "8cebf4ce2327", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,51-16-65037-11-23-4832-18-45-35-10-0-27-5-43-13-65281-51764-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1788681330, "last_seen": 1789946154, "transport": "t", "ja3_hash": "3968877e89e88b437f6cae6460d171ff", "ja3_variant_count": 7, "ja3_variants": [ "3968877e89e88b437f6cae6460d171ff", "882a14bbdb1f5af899a1ff47889aec43", "dc06bdf3994e95f194f225ba71295620", "f353c74ffce864fbcb56bb99e50fd33f", "c26cd6c6ec54af1da51de2141088f775", "a9ef0b709291ed61bd758ae206aeda59", "ded4e79f3c9dd727e08d4fb4fe87bd7b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 18, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 29 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_92da371f693a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "92da371f693a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-51-11-18-51764-10-0-17613-45-27-35-65281-5-16-43-13-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1788550342, "last_seen": 1789657048, "transport": "t", "ja3_hash": "381092888baca744719a435ae440b5dd", "ja3_variant_count": 14, "ja3_variants": [ "381092888baca744719a435ae440b5dd", "f9e9f0e2e516c53d0fcd5e4f89318d9c", "13453f15d2f29102eb5f0f51f0d69e43", "0363de9adcc470a5e4622ef3b8d668b9", "28756752570a7899425d48cc2d56b6ab", "0d58dd6103b76286d1b029ab85a204bd", "340b4c1ea9a75a9d4078117d68e3e25e", "9ae5510e25889f36f8898e55301edad5", "5dd153a84f97f280a572fea33359dfaf", "5287d791555c33fe8de59214a23c75ce", "40f60060ad6cdb5545e2ff87cb8ac807", "5493a51df2e83ba9012c647ed58a9a40" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 39, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_94861d7492ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "94861d7492ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-0-65281-27-23-45-43-5-13-16-11-10-65037-17613-51-51764-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788554571, "last_seen": 1789656405, "transport": "t", "ja3_hash": "805cb128685d95fbbdf31f0748a46962", "ja3_variant_count": 4, "ja3_variants": [ "805cb128685d95fbbdf31f0748a46962", "b2d7ecdb4ffe87f38be0a2a6de90d297", "5916ab1a0eca9977de2759a0d0cac9e2", "13018ee4fe2b52d3e090964e3362345a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_a83e75488472", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "a83e75488472", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-45-16-13-0-10-43-65281-51764-11-17613-5-51-18-35-23-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788573840, "last_seen": 1789669087, "transport": "t", "ja3_hash": "39097e17d62990d652cd230630ee0a73", "ja3_variant_count": 10, "ja3_variants": [ "39097e17d62990d652cd230630ee0a73", "d1c30b188f859fdbb91b27f65794dc2b", "29a53953308d153ea3fa3edb98783ac7", "d08ae2a6d22afd8a923e3ce4936270e4", "156a6803129ab856cd84a9cfec19c751", "678c980afc1cc01f5af18ea31aef4e82", "c840288dcfbf086aa3a5a4d3339273f7", "f4ec7a047ecbeba14c7dea7797fa85b2", "604f6a7071419eaf1a18dc9c744aed5b", "9410215dc842ad287ee9da19375b7cb5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 61 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_b1777264716f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "b1777264716f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-4832-5-35-65037-65281-13-11-45-0-16-17613-27-23-43-10-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788575662, "last_seen": 1788725824, "transport": "t", "ja3_hash": "addeae62dab0c4b6dca5cd67b6d74ded", "ja3_variant_count": 3, "ja3_variants": [ "addeae62dab0c4b6dca5cd67b6d74ded", "203a95d7ac67477072d9ff3a8c60abb6", "a82d84c61cabe2ffed1e9a2936979fbf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_b978bdcc2607", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "b978bdcc2607", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-23-11-5-35-43-4832-51-16-45-17613-65281-0-18-51764-65037-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788842783, "last_seen": 1789375021, "transport": "t", "ja3_hash": "fa42236149d70281bb93ed3ce9565eff", "ja3_variant_count": 4, "ja3_variants": [ "fa42236149d70281bb93ed3ce9565eff", "e43b3a5e78aec9c2f218d1ab1a55f24d", "704b74a92e4050078dcc9bb94ee14b72", "1b3344c51e9c7e1f839b71b7ef7cb05b" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 184, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_b97b09fa7adb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "b97b09fa7adb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-23-43-45-10-0-13-18-65281-16-17613-65037-11-51764-27-5-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1788550306, "last_seen": 1789669088, "transport": "t", "ja3_hash": "e49fc283d5b20a87d1274b1be4cac8db", "ja3_variant_count": 12, "ja3_variants": [ "e49fc283d5b20a87d1274b1be4cac8db", "d395f83f23e51c0d244a498bb9f65117", "6b6f4c35a61529c3e531128cf19a6d2e", "358f7769912edc7a18aa84b3a3f5f161", "178be80169dde9efe24d4c254675034c", "a8816464ea81ef5568523100c6ddec65", "77a601e1fb18f1e8fe1f502d644820be", "6c49e741f389a9c1a05ebaeaa2b41fd6", "3013bbd237046747ebc4e6a5a3b1c79e", "f21095d09fd19df1dba56ac818e3f25c", "3685cfab02e8e4a68a3594795ecdc580", "63fe177638b999928b7ced80b887cb50" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 65, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 67, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 81 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_c23320c3fa2a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "c23320c3fa2a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-17613-65037-18-43-51-27-65281-13-35-0-45-5-16-11-51764-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788552990, "last_seen": 1789656896, "transport": "t", "ja3_hash": "02cbacc8a8f8e14f3eb9fb020b202415", "ja3_variant_count": 8, "ja3_variants": [ "02cbacc8a8f8e14f3eb9fb020b202415", "4f7e61d9d88f4679a72464e085f88869", "0e9bcf4e4b9a9785f00ad5e1b6e28712", "a14dacd827bab8f0d31a476f8335bfa4", "586b0197423ea4f372b1a1235970e612", "07fa0766e18ef486511b58ee19456057", "fbe86a1882f3a1ff4a3573cbead84e30", "642d395847cc3eb1ae33f56a761e185f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 57, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 90, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": true } }, { "hash": "t13d1518h2_8daaf6152771_d5f01608aba7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "d5f01608aba7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51764-45-65281-4832-35-65037-18-51-17613-27-5-16-11-23-10-43-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788810238, "last_seen": 1789701014, "transport": "t", "ja3_hash": "934104360ddb708da4c28e3a49b9b9fa", "ja3_variant_count": 5, "ja3_variants": [ "934104360ddb708da4c28e3a49b9b9fa", "ab5d041aa7fefaa61ebae6302cd87e24", "a195f6c1ffd2ddfde83e9c2066db7bb0", "4c9f33a4ebe3ad8d9ceefe302a299324", "d0c26a125fec08c377555ecd854d9dfe" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_e051bf92a81a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "e051bf92a81a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,23-5-18-43-10-17613-4832-11-51-0-27-65037-51764-13-65281-16-45-35,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788910944, "last_seen": 1789946155, "transport": "t", "ja3_hash": "fa49faafa6608ace39bcf4af63a84376", "ja3_variant_count": 2, "ja3_variants": [ "fa49faafa6608ace39bcf4af63a84376", "7be96c0fe60f54cb0a885a13cadb6849" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_e58fcb275dc7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "e58fcb275dc7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-45-65037-43-65281-5-16-10-18-51-51764-13-23-11-0-35-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 13, "first_seen": 1788459876, "last_seen": 1789646114, "transport": "t", "ja3_hash": "445233f32d7e84fc96258846b44975cd", "ja3_variant_count": 13, "ja3_variants": [ "445233f32d7e84fc96258846b44975cd", "6d52c46ae797b5f77a86fdaa8c12c5e3", "8afdd3419463794758f8497297bc2ae8", "71353f772a56da28e7b3f3d5d7d5de63", "e2e954bed0814827368920c08cc0070b", "5db6bfeb161ad49576ec43f89c7a47aa", "cceb7ff10f442079f8e93de7a01c3be0", "069bbdf7582b211bcc571f72178cbf99", "4c37e6e416899cf6dbae8533f8178050", "eed828150f090f87f328f495dbc932a0", "2001d07947346e7e4ba0d54e9e73cfc8", "5f8e8ad972400b10024242d893e51006" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 66, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 48, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_f242d6c68ddd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "f242d6c68ddd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-16-18-5-0-23-13-65281-11-51764-27-65037-51-10-43-45-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 13, "first_seen": 1788459875, "last_seen": 1789657891, "transport": "t", "ja3_hash": "999ec791f8fdc5c8d7a81747f7cd0e49", "ja3_variant_count": 13, "ja3_variants": [ "999ec791f8fdc5c8d7a81747f7cd0e49", "4da5a87da25519997fd249e749ef3051", "a4c8655753c1f88ad95220dc4cef939b", "ff6d358e0baa2efa2c3b0b0e98ccd6d1", "29de46c20337d72f7dd8c31576b9153a", "991ed1c2da5e7ef408fa646fa2c7e9db", "2524beb61735e6305bca043541bf88c5", "f085f5896e5bb42a3d416cda96e0edd1", "65cb81ca791196ae83bca2643f0fef3f", "6d76203bafbafc023d86e9a5105970a6", "817c5e3ec1e0acd8fce9e286e797bda9", "13432ce7e3a3ad300d531bb7f4ecee71" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 84, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 35 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_f985745adfa6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "f985745adfa6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-35-51764-16-23-4832-0-45-11-10-51-65037-18-65281-13-17613-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788810238, "last_seen": 1789350292, "transport": "t", "ja3_hash": "2d9e836248d2167321052af1e531e4c8", "ja3_variant_count": 8, "ja3_variants": [ "2d9e836248d2167321052af1e531e4c8", "5bf2574e127d8503b41cd08f7dd5610d", "4fe0aec69f38994b11def1ad9cac89f5", "fc8734590406a0cf5b1173a8dfaccb8d", "97e49679522d0bdbade93f007720c251", "f7d57cec6817539993b05151575e12c9", "f3f784c12531e6bcbe0adc9d1ffec189", "19ac1040b9939c9669ad57bd9edbde5e" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d1519h2_8daaf6152771_8c8d81a5e528", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1519h2", "b": "8daaf6152771", "c": "8c8d81a5e528", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 19, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-5-10-4832-27-0-45-35-23-65037-16-65281-13-51764-18-51-43-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788681337, "last_seen": 1788681337, "transport": "t", "ja3_hash": "b8a1efb795b81963adb5e406dc99a6bb", "ja3_variant_count": 1, "ja3_variants": [ "b8a1efb795b81963adb5e406dc99a6bb" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1519h2_8daaf6152771_bd248ed37839", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1519h2", "b": "8daaf6152771", "c": "bd248ed37839", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 19, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51764-51-17613-27-10-43-16-0-18-4832-11-13-23-45-65281-65037-35-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788681338, "last_seen": 1788681338, "transport": "t", "ja3_hash": "f4a44e1309f7eefb16de204d914252b8", "ja3_variant_count": 1, "ja3_variants": [ "f4a44e1309f7eefb16de204d914252b8" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1610h2_926abbf9e651_b0ef02ef599f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1610h2", "b": "926abbf9e651", "c": "b0ef02ef599f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-49199-157-156-49162-49172-49161-49171-53-47-255,0-11-10-16-23-13-43-45-51-21,23-24-25-29,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789575158, "last_seen": 1789575242, "transport": "t", "ja3_hash": "2a794baa93aba5904b026743a3b1d665", "ja3_variant_count": 1, "ja3_variants": [ "2a794baa93aba5904b026743a3b1d665" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Safari/605.1.15": 52, "com.apple.WebKit.Networking/20624.2.5.18.3 Network/4277.140.33.703.1 macOS/15.7.9": 10 }, "ua_disagreement": false } }, { "hash": "t13d161100_1711a4c0508c_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d161100", "b": "1711a4c0508c", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789012884, "last_seen": 1789012888, "transport": "t", "ja3_hash": "e4fcd81135fae195754d680b3dac7566", "ja3_variant_count": 1, "ja3_variants": [ "e4fcd81135fae195754d680b3dac7566" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1611h2_1711a4c0508c_d180211ea38a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1611h2", "b": "1711a4c0508c", "c": "d180211ea38a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53-255,0-11-10-35-5-16-23-13-43-45-51,29-23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 25, "first_seen": 1788299257, "last_seen": 1788877792, "transport": "t", "ja3_hash": "32daeeceb3400621714e983e136c78f0", "ja3_variant_count": 1, "ja3_variants": [ "32daeeceb3400621714e983e136c78f0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 29, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 317 }, "ua_disagreement": false } }, { "hash": "t13d1611h2_1711a4c0508c_edf9f1f95545", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1611h2", "b": "1711a4c0508c", "c": "edf9f1f95545", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-255,0-11-10-35-5-16-23-13-43-45-51,29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 55, "first_seen": 1788336476, "last_seen": 1789731275, "transport": "t", "ja3_hash": "4f2d63c6a35e03e0917bcb5c7d1d6540", "ja3_variant_count": 1, "ja3_variants": [ "4f2d63c6a35e03e0917bcb5c7d1d6540" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 78, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 51 }, "ua_disagreement": false } }, { "hash": "t13d1612h2_1711a4c0508c_2f0eefca25b4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1612h2", "b": "1711a4c0508c", "c": "2f0eefca25b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-255,0-11-10-35-5-16-23-13-43-45-51-21,29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 8, "first_seen": 1789362534, "last_seen": 1789362543, "transport": "t", "ja3_hash": "b575840c0d22f540c5cfe867d963a259", "ja3_variant_count": 1, "ja3_variants": [ "b575840c0d22f540c5cfe867d963a259" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 50 }, "ua_disagreement": false } }, { "hash": "t13d1612ht_1711a4c0508c_8a448b0eddb4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1612ht", "b": "1711a4c0508c", "c": "8a448b0eddb4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1789450886, "last_seen": 1789450888, "transport": "t", "ja3_hash": "95bc9b675f4acd37b89e821534de8b11", "ja3_variant_count": 1, "ja3_variants": [ "95bc9b675f4acd37b89e821534de8b11" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 17 }, "ua_disagreement": false } }, { "hash": "t13d1614h2_86a278354501_8c454e6c488f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1614h2", "b": "86a278354501", "c": "8c454e6c488f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-28-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788480414, "last_seen": 1788480460, "transport": "t", "ja3_hash": "996033a4a134cd993d7f0ecfab09e3cc", "ja3_variant_count": 1, "ja3_variants": [ "996033a4a134cd993d7f0ecfab09e3cc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:153.0) Gecko/20100101 Firefox/153.0": 28 }, "ua_disagreement": false } }, { "hash": "t13d1615h2_46e7e9700bed_cadd4ee51f0b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1615h2", "b": "46e7e9700bed", "c": "cadd4ee51f0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1787559267, "last_seen": 1789852851, "transport": "t", "ja3_hash": "66918128f1b9b03303d77c6f2eefd128", "ja3_variant_count": 1, "ja3_variants": [ "66918128f1b9b03303d77c6f2eefd128" ], "user_agents": { "Go-http-client/2.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0": 23, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3835.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1615h2_86a278354501_bfd03865c479", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1615h2", "b": "86a278354501", "c": "bfd03865c479", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 18, "first_seen": 1787542125, "last_seen": 1788480455, "transport": "t", "ja3_hash": "b074ad2e08e2809192a32ad8042d1940", "ja3_variant_count": 1, "ja3_variants": [ "b074ad2e08e2809192a32ad8042d1940" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 66 }, "ua_disagreement": false } }, { "hash": "t13d1616h2_86a278354501_8e37aa83b3bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1616h2", "b": "86a278354501", "c": "8e37aa83b3bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787499293, "last_seen": 1789849263, "transport": "t", "ja3_hash": "5f084da4f92be5ecf20d3badb600820c", "ja3_variant_count": 1, "ja3_variants": [ "5f084da4f92be5ecf20d3badb600820c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 81, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 42, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0": 104 }, "ua_disagreement": false } }, { "hash": "t13d1617h2_86a278354501_7af0cb3b5dda", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1617h2", "b": "86a278354501", "c": "7af0cb3b5dda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 85, "first_seen": 1787459602, "last_seen": 1789927807, "transport": "t", "ja3_hash": "6447ab086255d194909d4013b1a89e87", "ja3_variant_count": 1, "ja3_variants": [ "6447ab086255d194909d4013b1a89e87" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 877, "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 /153.3.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0": 101 }, "ua_disagreement": false } }, { "hash": "t13d1617h2_86a278354501_98d29f222568", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1617h2", "b": "86a278354501", "c": "98d29f222568", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-45-28-27-65037-41,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 18, "first_seen": 1788261842, "last_seen": 1789849263, "transport": "t", "ja3_hash": "f19d54c853fffdd9eeab77ae607448e9", "ja3_variant_count": 1, "ja3_variants": [ "f19d54c853fffdd9eeab77ae607448e9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0": 152, "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 139 }, "ua_disagreement": false } }, { "hash": "t13d1710h2_5b57614c22b0_b162e96b8768", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1710h2", "b": "5b57614c22b0", "c": "b162e96b8768", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-16-13-51-45-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 76, "first_seen": 1787555957, "last_seen": 1789662810, "transport": "t", "ja3_hash": "da6b4ed151e487ee5d4414c1b4833627", "ja3_variant_count": 1, "ja3_variants": [ "da6b4ed151e487ee5d4414c1b4833627" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 122, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 22, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Shap-User/0.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d171100_ab0a1bf427ad_6ecbdee5c734", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d171100", "b": "ab0a1bf427ad", "c": "6ecbdee5c734", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 84, "first_seen": 1787584026, "last_seen": 1789934909, "transport": "t", "ja3_hash": "e8df55bdfa49d878dc07891c00a025ce", "ja3_variant_count": 2, "ja3_variants": [ "e8df55bdfa49d878dc07891c00a025ce", "f21f8e6cf70d5980ecfe9fa2e0ef401c" ], "user_agents": { "Python-urllib/3.14": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0.0.0 Safari/537.36 Edg/125.0.0.0": 7, "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64)": 3, "StillCPAResearchBot/1.0 (homepage-only public-business research; +https://still-cpa.com/contact-us)": 2, "Mozilla/5.0": 5 }, "ua_disagreement": false } }, { "hash": "t13d1711h2_5b57614c22b0_fafec55f477d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1711h2", "b": "5b57614c22b0", "c": "fafec55f477d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-16-13-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 472, "first_seen": 1787484287, "last_seen": 1789852026, "transport": "t", "ja3_hash": "660a941f55bd4e528c12a52a9e9a4b03", "ja3_variant_count": 1, "ja3_variants": [ "660a941f55bd4e528c12a52a9e9a4b03" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 1340, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 36 }, "ua_disagreement": false } }, { "hash": "t13d171200_ab0a1bf427ad_55ac72f97122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d171200", "b": "ab0a1bf427ad", "c": "55ac72f97122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 31, "first_seen": 1787618501, "last_seen": 1789883156, "transport": "t", "ja3_hash": "e459f9ec156647e137eec3618527db1f", "ja3_variant_count": 1, "ja3_variants": [ "e459f9ec156647e137eec3618527db1f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 16, "Python/3.11 aiohttp/3.14.3": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 8 }, "ua_disagreement": true } }, { "hash": "t13d1712h2_5b57614c22b0_13426837f0ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1712h2", "b": "5b57614c22b0", "c": "13426837f0ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-52393-49199-52392-49161-49171-156-47-49196-49200-49162-49172-157-53,0-23-65281-10-11-35-16-13-51-45-43-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 797, "first_seen": 1787443979, "last_seen": 1789967949, "transport": "t", "ja3_hash": "f5bd742fa88333052a1deec09f821012", "ja3_variant_count": 2, "ja3_variants": [ "f5bd742fa88333052a1deec09f821012", "aa94d602ee60d8eba83a42f740bbdd37" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot": 237, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot": 552, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 8 }, "ua_disagreement": false } }, { "hash": "t13d1712h2_5b57614c22b0_bed454b11bd1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1712h2", "b": "5b57614c22b0", "c": "bed454b11bd1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-52393-49199-52392-49161-49171-156-47-49196-49200-49162-49172-157-53,0-23-65281-10-11-35-16-13-51-45-43-41,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 236, "first_seen": 1787464737, "last_seen": 1789967822, "transport": "t", "ja3_hash": "27441b2a2ac1d51a7f98ae44819494a5", "ja3_variant_count": 2, "ja3_variants": [ "27441b2a2ac1d51a7f98ae44819494a5", "df38140d306e29a5be0341b584e2450b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot": 30, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot": 211 }, "ua_disagreement": false } }, { "hash": "t13d1712ht_ab0a1bf427ad_be43a87a1363", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (be43a87a1363) with 2 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1712ht", "b": "ab0a1bf427ad", "c": "be43a87a1363", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 229, "first_seen": 1787464185, "last_seen": 1789967968, "transport": "t", "ja3_hash": "7291ea5e449f2c7b17582541703e549d", "ja3_variant_count": 1, "ja3_variants": [ "7291ea5e449f2c7b17582541703e549d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 26, "WhiteCircleTrustBot/1.0 (+https://whitecircle.ai/bots/trust-center-scraper)": 12, "Mozilla/5.0": 25 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1712ht_ab0a1bf427ad_c4728683d87f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1712ht", "b": "ab0a1bf427ad", "c": "c4728683d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 484, "first_seen": 1787505684, "last_seen": 1789959769, "transport": "t", "ja3_hash": "478843a4cce1e9955bfcf160342b6e11", "ja3_variant_count": 2, "ja3_variants": [ "478843a4cce1e9955bfcf160342b6e11", "37f7d09ced1a845dc48872abc1a29d7b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +searchbot@anthropic.com)": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36 (+centryx-domain-mill; contact beinn.yule@centryx.ai)": 3, "msh-pdfmin/1": 301, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t13d1713h2_5b57614c22b0_1d486f7b386c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713h2", "b": "5b57614c22b0", "c": "1d486f7b386c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,10-5-65037-11-43-18-27-0-28-16-65281-13-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789777486, "last_seen": 1789777486, "transport": "t", "ja3_hash": "53fe84d79f2c993624393ba967355179", "ja3_variant_count": 1, "ja3_variants": [ "53fe84d79f2c993624393ba967355179" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.2180.105 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1713h2_5b57614c22b0_514943fa2261", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713h2", "b": "5b57614c22b0", "c": "514943fa2261", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 67, "first_seen": 1787563445, "last_seen": 1789801329, "transport": "t", "ja3_hash": "ed3d2cb3d86125377f5a4d48e431af48", "ja3_variant_count": 6, "ja3_variants": [ "ed3d2cb3d86125377f5a4d48e431af48", "da8cae6a7c37d52494383a102529844a", "72f9e974237ac466af0906504c230753", "f1a2823d1c629f0161bd1f1ff6232286", "fb59d4657aa9f1cde09b7b9e79b54467", "68ca5fd4b2d35b454c1ccfa6156b272f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3748.26 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.2009.38 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.2879.177 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3530.119 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3360.67 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3680.139 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3489.160 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3358.44 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1713h2_5b57614c22b0_571c9eeffdb5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713h2", "b": "5b57614c22b0", "c": "571c9eeffdb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-52393-49199-52392-49161-49171-156-47-49196-49200-49162-49172-157-53,0-23-65281-10-11-35-16-13-51-45-43-21-41,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 440, "first_seen": 1787457740, "last_seen": 1789967821, "transport": "t", "ja3_hash": "aa2d0ad206e0981d695e9266f3fa2d65", "ja3_variant_count": 2, "ja3_variants": [ "aa2d0ad206e0981d695e9266f3fa2d65", "da404a616232aa8d719c50558af9aead" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot": 401, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot": 45, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 18 }, "ua_disagreement": false } }, { "hash": "t13d1713h2_5b57614c22b0_c38ec3c5e609", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713h2", "b": "5b57614c22b0", "c": "c38ec3c5e609", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788638704, "last_seen": 1788960069, "transport": "t", "ja3_hash": "ad55557b7cbd735c2627f7ebb3b3d493", "ja3_variant_count": 1, "ja3_variants": [ "ad55557b7cbd735c2627f7ebb3b3d493" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:109.0) Gecko/20100101 Firefox/115.0": 13, "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0": 13 }, "ua_disagreement": false } }, { "hash": "t13d1713ht_5b57614c22b0_aea78d538e14", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "5b57614c22b0", "c": "aea78d538e14", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49196-52393-49199-49200-52392-49161-49162-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789494053, "last_seen": 1789964379, "transport": "t", "ja3_hash": "9b02ebd3a43b62d825e1ac605b621dc8", "ja3_variant_count": 1, "ja3_variants": [ "9b02ebd3a43b62d825e1ac605b621dc8" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:24.0) Gecko/20100101 Firefox/24.0 Chrome/80.0.3987.132 Safari/537.36": 1, "WhatsApp/2.23.20.0": 5 }, "ua_disagreement": false } }, { "hash": "t13d1713ht_ab0a1bf427ad_227f730ea371", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "ab0a1bf427ad", "c": "227f730ea371", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-16-22-23-49-13-43-45-51-21,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 36, "first_seen": 1787505988, "last_seen": 1789930541, "transport": "t", "ja3_hash": "40f10d0eb1d9d3e660aa85c7eb3555a8", "ja3_variant_count": 1, "ja3_variants": [ "40f10d0eb1d9d3e660aa85c7eb3555a8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.35/36 Safari/537.36": 36 }, "ua_disagreement": false } }, { "hash": "t13d1713ht_ab0a1bf427ad_99c94103f5e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "ab0a1bf427ad", "c": "99c94103f5e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-16-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 523, "first_seen": 1787443086, "last_seen": 1789968308, "transport": "t", "ja3_hash": "06873b563b993c62a40abbbdb28d2f21", "ja3_variant_count": 1, "ja3_variants": [ "06873b563b993c62a40abbbdb28d2f21" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; YouBot/1.0; +https://docs.you.com/youbot; env:prod) Chrome/142.0.0.0 Safari/537.36": 185, "Mozilla/5.0 (X11; Linux i686; rv:109.0) Gecko/20100101 Firefox/120.0": 7, "Python/3.13 aiohttp/3.14.1": 42 }, "ua_disagreement": true } }, { "hash": "t13d1714h2_5b57614c22b0_50ede07022fd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1714h2", "b": "5b57614c22b0", "c": "50ede07022fd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 33, "first_seen": 1787569170, "last_seen": 1789749348, "transport": "t", "ja3_hash": "a767f8ae9115cc5752e5cff59612e74f", "ja3_variant_count": 2, "ja3_variants": [ "a767f8ae9115cc5752e5cff59612e74f", "aa2f8a6304a024c468699c41bb2a46da" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.2738.192 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3541.187 Safari/537.36": 2, "Mozilla/5.0 (Android 10; Mobile; rv:140.0) Gecko/140.0 Firefox/140.0": 125, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3001.78 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1714h2_5b57614c22b0_8c454e6c488f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1714h2", "b": "5b57614c22b0", "c": "8c454e6c488f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1789762411, "last_seen": 1789954145, "transport": "t", "ja3_hash": "75603adb8780ff56ed5ffdf57fe8b4cc", "ja3_variant_count": 1, "ja3_variants": [ "75603adb8780ff56ed5ffdf57fe8b4cc" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d1714ht_5b57614c22b0_8667f5695ef6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1714ht", "b": "5b57614c22b0", "c": "8667f5695ef6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 117, "first_seen": 1787473012, "last_seen": 1789929696, "transport": "t", "ja3_hash": "d871d02cecbde59abbf8f4806134addf", "ja3_variant_count": 1, "ja3_variants": [ "d871d02cecbde59abbf8f4806134addf" ], "user_agents": { "Bun/1.3.14": 2, "Bun/1.4.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 112 }, "ua_disagreement": false } }, { "hash": "t13d1715h2_5b57614c22b0_32db7dcf895c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1715h2", "b": "5b57614c22b0", "c": "32db7dcf895c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1787666461, "last_seen": 1789534388, "transport": "t", "ja3_hash": "b5001237acdf006056b409cc433726b0", "ja3_variant_count": 1, "ja3_variants": [ "b5001237acdf006056b409cc433726b0" ], "user_agents": { "MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner)": 40, "Mozilla/5.0 (Android 16; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0": 6, "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0": 13 }, "ua_disagreement": false } }, { "hash": "t13d1715h2_5b57614c22b0_5ad411fbfabb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1715h2", "b": "5b57614c22b0", "c": "5ad411fbfabb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 122, "first_seen": 1787508094, "last_seen": 1789954146, "transport": "t", "ja3_hash": "7704a11cf87dfcf33080b90ce11d5527", "ja3_variant_count": 2, "ja3_variants": [ "7704a11cf87dfcf33080b90ce11d5527", "fae2d0ee1d76703828d9af1c91a959de" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3458.20 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 553, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3232.14 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 544 }, "ua_disagreement": false } }, { "hash": "t13d1715h2_e08a0f08260f_5563d4852cd1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (5563d4852cd1) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1715h2", "b": "e08a0f08260f", "c": "5563d4852cd1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "257,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-57363-57427-156-157-47-53,23-65281-10-11-35-16-5-13-18-51-45-43-27-21-0,29-23-24,0", "ja3_decoded": { "version": { "value": 257, "name": "257 (0x0101)" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57363, "name": "57363 (0xe013)", "known": false }, { "value": 57427, "name": "57427 (0xe053)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1787461185, "last_seen": 1788943919, "transport": "t", "ja3_hash": "ef53b4052670264d7c747d36964b86e4", "ja3_variant_count": 1, "ja3_variants": [ "ef53b4052670264d7c747d36964b86e4" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1716h2_5b57614c22b0_494fa9cd0083", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (494fa9cd0083) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1716h2", "b": "5b57614c22b0", "c": "494fa9cd0083", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-45-28-27-65037-41,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789366660, "last_seen": 1789366660, "transport": "t", "ja3_hash": "1bd037f4362e6fb24b2718009dd1049a", "ja3_variant_count": 1, "ja3_variants": [ "1bd037f4362e6fb24b2718009dd1049a" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1716h2_5b57614c22b0_7e448db9ea6e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1716h2", "b": "5b57614c22b0", "c": "7e448db9ea6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1788390098, "last_seen": 1789739697, "transport": "t", "ja3_hash": "2d692a4485ca2f5f2b10ecb2d2909ad3", "ja3_variant_count": 1, "ja3_variants": [ "2d692a4485ca2f5f2b10ecb2d2909ad3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0": 4, "Mozilla/5.0 (Android 16; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0": 27 }, "ua_disagreement": false } }, { "hash": "t13d1716h2_5b57614c22b0_8e37aa83b3bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1716h2", "b": "5b57614c22b0", "c": "8e37aa83b3bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 38, "first_seen": 1788884310, "last_seen": 1789931606, "transport": "t", "ja3_hash": "aa335cae1834c8200477ce25932b9ad0", "ja3_variant_count": 1, "ja3_variants": [ "aa335cae1834c8200477ce25932b9ad0" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 695 }, "ua_disagreement": false } }, { "hash": "t13d1717h2_5b57614c22b0_7af0cb3b5dda", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1717h2", "b": "5b57614c22b0", "c": "7af0cb3b5dda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 799, "first_seen": 1787456795, "last_seen": 1789946685, "transport": "t", "ja3_hash": "6f7889b9fb1a62a9577e685c1fcfa919", "ja3_variant_count": 1, "ja3_variants": [ "6f7889b9fb1a62a9577e685c1fcfa919" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0": 40, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:147.0) Gecko/20100101 Firefox/147.0": 18, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0": 652 }, "ua_disagreement": false } }, { "hash": "t13d1717h2_5b57614c22b0_98d29f222568", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (98d29f222568) with 2 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1717h2", "b": "5b57614c22b0", "c": "98d29f222568", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-45-28-27-65037-41,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789641896, "last_seen": 1789846477, "transport": "t", "ja3_hash": "0e76c7e9d06fa0e211b1827687dd8f43", "ja3_variant_count": 1, "ja3_variants": [ "0e76c7e9d06fa0e211b1827687dd8f43" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d181000_85036bcba153_1075c442c310", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181000", "b": "85036bcba153", "c": "1075c442c310", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 24, "first_seen": 1787649935, "last_seen": 1789643454, "transport": "t", "ja3_hash": "80a0681edf7be3a4d5dc90fc39055d22", "ja3_variant_count": 1, "ja3_variants": [ "80a0681edf7be3a4d5dc90fc39055d22" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13d181100_85036bcba153_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181100", "b": "85036bcba153", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 670, "first_seen": 1787489400, "last_seen": 1789876081, "transport": "t", "ja3_hash": "5833fcd5a2599274dacc5a94102ac943", "ja3_variant_count": 2, "ja3_variants": [ "5833fcd5a2599274dacc5a94102ac943", "93c7d42c0df602fb91589311534831f5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 52, "Python-urllib/3.12": 2, "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36": 318, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1812ht_5d04281c6031_13426837f0ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (13426837f0ce) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1812ht", "b": "5d04281c6031", "c": "13426837f0ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49199-49195-49200-49196-49191-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-16-13-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789196366, "last_seen": 1789955186, "transport": "t", "ja3_hash": "1a3153f314dc13e133dc71d113a81b16", "ja3_variant_count": 1, "ja3_variants": [ "1a3153f314dc13e133dc71d113a81b16" ], "user_agents": { "Mozilla/5.0": 3, "modsearch (+https://github.com/liustack/modsearch)": 1 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1812ht_85036bcba153_6c7c91134a62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1812ht", "b": "85036bcba153", "c": "6c7c91134a62", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 647, "first_seen": 1787445858, "last_seen": 1789950207, "transport": "t", "ja3_hash": "304734bb1c086c3453b387400cf83f11", "ja3_variant_count": 2, "ja3_variants": [ "304734bb1c086c3453b387400cf83f11", "004bf73563645cc1faefe99886ed32eb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3": 15, "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/5d7.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko/20100101 Firefox/141.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 (PhantomJsCloud.com/6.2025.4.20)": 2, "Mozilla/5.0 (compatible; SectorBot/1.0; +https://serdartorun.dev/bot) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1812ht_85036bcba153_d89d4c7b8e02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1812ht", "b": "85036bcba153", "c": "d89d4c7b8e02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 489, "first_seen": 1787468195, "last_seen": 1789939097, "transport": "t", "ja3_hash": "47f56493e551459ad91fdee8f61435f3", "ja3_variant_count": 2, "ja3_variants": [ "47f56493e551459ad91fdee8f61435f3", "a48c0d5f95b1ef98f560f324fd275da1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0": 51, "python-requests/2.34.2": 7, "python-requests/2.32.5": 12, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 24, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 13 }, "ua_disagreement": true } }, { "hash": "t13d1813ht_5103eae14fdb_b1b76f043750", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1813ht", "b": "5103eae14fdb", "c": "b1b76f043750", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 29, "first_seen": 1789597670, "last_seen": 1789597672, "transport": "t", "ja3_hash": "d3c5950d2c1a2ed6f6344805e61005a2", "ja3_variant_count": 1, "ja3_variants": [ "d3c5950d2c1a2ed6f6344805e61005a2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 60 }, "ua_disagreement": false } }, { "hash": "t13d1813ht_85036bcba153_6b9dd2e5c643", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1813ht", "b": "85036bcba153", "c": "6b9dd2e5c643", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,0-11-10-35-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 389, "first_seen": 1787570146, "last_seen": 1789768142, "transport": "t", "ja3_hash": "331a436afb23d4e31134c11b301bdcb5", "ja3_variant_count": 2, "ja3_variants": [ "331a436afb23d4e31134c11b301bdcb5", "629273f159de88e0d3860a95d94ac128" ], "user_agents": { "KingfisherIngest/1.0 (+https://github.com/tldrmedia/kingfisher)": 5, "wp2shell": 23, "CodeMMPretrainCrawler/1.0": 139, "hn-ai-research-archive/1.0 (+noncommercial research)": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1814ht_5103eae14fdb_575b7503f51b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1814ht", "b": "5103eae14fdb", "c": "575b7503f51b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-16-22-23-49-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788535156, "last_seen": 1789572191, "transport": "t", "ja3_hash": "ed5d44508b4c00e058be147ed87e7830", "ja3_variant_count": 1, "ja3_variants": [ "ed5d44508b4c00e058be147ed87e7830" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1816h2_e8a523a41297_7b0b2a9ab28f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1816h2", "b": "e8a523a41297", "c": "7b0b2a9ab28f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-16-5-34-18-51-43-13-45-28-65037-41,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787749791, "last_seen": 1788610449, "transport": "t", "ja3_hash": "77e18ee7f135525b68db30e448032200", "ja3_variant_count": 1, "ja3_variants": [ "77e18ee7f135525b68db30e448032200" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 7 }, "ua_disagreement": false } }, { "hash": "t13d1910ht_9dc949149365_466c27a6074e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1910ht", "b": "9dc949149365", "c": "466c27a6074e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,0-5-10-11-13-65281-16-18-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788488556, "last_seen": 1789763693, "transport": "t", "ja3_hash": "fb2f41ad1ff624286946b588576a70de", "ja3_variant_count": 1, "ja3_variants": [ "fb2f41ad1ff624286946b588576a70de" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d191100_9dc949149365_0fe28f4911d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d191100", "b": "9dc949149365", "c": "0fe28f4911d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 119, "first_seen": 1787724793, "last_seen": 1789960943, "transport": "t", "ja3_hash": "27d8c260ed098a8ad17fa38232a7e7ae", "ja3_variant_count": 1, "ja3_variants": [ "27d8c260ed098a8ad17fa38232a7e7ae" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36": 2, "Mozilla/5.0 (compatible; SecurityResearch/1.0; )": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64)": 2 }, "ua_disagreement": false } }, { "hash": "t13d191100_9dc949149365_8cc08dffc9e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d191100", "b": "9dc949149365", "c": "8cc08dffc9e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 11, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,0-5-10-11-35-13-65281-18-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 58, "first_seen": 1787472284, "last_seen": 1789949946, "transport": "t", "ja3_hash": "d6199990cfdd3e02bffa3af7a530275c", "ja3_variant_count": 1, "ja3_variants": [ "d6199990cfdd3e02bffa3af7a530275c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36": 58 }, "ua_disagreement": false } }, { "hash": "t13d1912h2_9dc949149365_b246ff971066", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1912h2", "b": "9dc949149365", "c": "b246ff971066", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 46, "first_seen": 1787458554, "last_seen": 1789769946, "transport": "t", "ja3_hash": "d113e8b9d55b97b77077806180483c96", "ja3_variant_count": 1, "ja3_variants": [ "d113e8b9d55b97b77077806180483c96" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36": 41, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d2010ht_a8347f2c98c8_cb70cd1b205f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2010ht", "b": "a8347f2c98c8", "c": "cb70cd1b205f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49191-49162-49172-49192-156-157-47-60-53,0-23-65281-10-11-16-13-51-45-43,4588-4587-4589-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789931523, "last_seen": 1789931523, "transport": "t", "ja3_hash": "df2012b9d3c890a1c5379000474d9561", "ja3_variant_count": 1, "ja3_variants": [ "df2012b9d3c890a1c5379000474d9561" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ABEvalBot/0.1) Version/11.1.2 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13d201100_2b729b4bf6f3_2b2467513d7e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d201100", "b": "2b729b4bf6f3", "c": "2b2467513d7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-11-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 395, "first_seen": 1787442955, "last_seen": 1789892753, "transport": "t", "ja3_hash": "68b3ecfaf0034bb9fcbecd518b5ab8d4", "ja3_variant_count": 2, "ja3_variants": [ "68b3ecfaf0034bb9fcbecd518b5ab8d4", "9085f08651f3d508044b9e41a776f45f" ], "user_agents": { "ddg_win": 57, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 818, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d201200_2b729b4bf6f3_7e1dbb44d532", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d201200", "b": "2b729b4bf6f3", "c": "7e1dbb44d532", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-5-43-13-35-10-11-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 46, "first_seen": 1787473471, "last_seen": 1789871770, "transport": "t", "ja3_hash": "2800f914a7a4ba98aa9df62d316a460c", "ja3_variant_count": 1, "ja3_variants": [ "2800f914a7a4ba98aa9df62d316a460c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/79.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d201200_2b729b4bf6f3_d42405ff081a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d201200", "b": "2b729b4bf6f3", "c": "d42405ff081a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-11-51-49-23-65281-45-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 64, "first_seen": 1787443427, "last_seen": 1789787641, "transport": "t", "ja3_hash": "6ad69cecca55b3321a3261b1ae4aaab1", "ja3_variant_count": 1, "ja3_variants": [ "6ad69cecca55b3321a3261b1ae4aaab1" ], "user_agents": { "ddg_win": 52, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d2013h2_2b729b4bf6f3_b9165cb4b096", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2013h2", "b": "2b729b4bf6f3", "c": "b9165cb4b096", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-5-43-13-35-10-11-16-51-49-23-65281-45,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 231, "first_seen": 1787443162, "last_seen": 1789954843, "transport": "t", "ja3_hash": "d4ed3e50e6fccfcd0b8f2635bcec55ff", "ja3_variant_count": 1, "ja3_variants": [ "d4ed3e50e6fccfcd0b8f2635bcec55ff" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36": 268 }, "ua_disagreement": false } }, { "hash": "t13d2013h2_a09f3c656075_fb18a4f6686c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2013h2", "b": "a09f3c656075", "c": "fb18a4f6686c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 309, "first_seen": 1787488764, "last_seen": 1789904382, "transport": "t", "ja3_hash": "ecdf4f49dd59effc439639da29186671", "ja3_variant_count": 1, "ja3_variants": [ "ecdf4f49dd59effc439639da29186671" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1": 338, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Safari/605.1.15": 258, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Mobile/15E148 Safari/604.1": 99 }, "ua_disagreement": false } }, { "hash": "t13d2014h2_a09f3c656075_1cccc7bac6be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2014h2", "b": "a09f3c656075", "c": "1cccc7bac6be", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-43-51-18-11-45-5-23-13-10-27-65281-16-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789749595, "last_seen": 1789788739, "transport": "t", "ja3_hash": "72ed740b30d13d60b2a7812049151974", "ja3_variant_count": 5, "ja3_variants": [ "72ed740b30d13d60b2a7812049151974", "bf3d8492a30d1099cb0d0b9308e1a5f4", "a073cd21467d575479e154f6cc3f8afa", "83b9eb790a8e69700b75e504426652f2", "d51347e0b4417e6b42a9f6a17bb5a01c" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.2455.8 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3776.37 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.2871.191 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3074.111 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3212.166 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d2014h2_a09f3c656075_31edcf4f4949", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2014h2", "b": "a09f3c656075", "c": "31edcf4f4949", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 325, "first_seen": 1787464750, "last_seen": 1789942333, "transport": "t", "ja3_hash": "773906b0efdefa24a7f2b8eb6985bf37", "ja3_variant_count": 1, "ja3_variants": [ "773906b0efdefa24a7f2b8eb6985bf37" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3024.75 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Safari/605.1.15": 77, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1": 35 }, "ua_disagreement": false } }, { "hash": "t13d2014h2_a09f3c656075_575785468cb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2014h2", "b": "a09f3c656075", "c": "575785468cb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,65281-11-10-35-5-22-18-23-13-43-45-51-0-16,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1789499564, "last_seen": 1789525652, "transport": "t", "ja3_hash": "5d42ca7c7fa584cce7692c676bc78c6f", "ja3_variant_count": 1, "ja3_variants": [ "5d42ca7c7fa584cce7692c676bc78c6f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/27.0 Safari/605.1.15": 344, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Safari": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko)": 11 }, "ua_disagreement": false } }, { "hash": "t13d2014h2_a09f3c656075_d79dab2964a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2014h2", "b": "a09f3c656075", "c": "d79dab2964a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-35-16-5-13-18-51-45-43-27,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788597368, "last_seen": 1788757503, "transport": "t", "ja3_hash": "6618231821d2d40f8d1859f5a43a0307", "ja3_variant_count": 1, "ja3_variants": [ "6618231821d2d40f8d1859f5a43a0307" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15": 3 }, "ua_disagreement": false } }, { "hash": "t13d210900_6b2954d954da_e7627c074108", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d210900", "b": "6b2954d954da", "c": "e7627c074108", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49172-57-49171-51-157-156-53-47-255,0-11-10-22-23-13-43-45-51,4588-29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 37, "first_seen": 1788847217, "last_seen": 1788855111, "transport": "t", "ja3_hash": "7a07b517a5302a7ffd8b1151b81869e7", "ja3_variant_count": 1, "ja3_variants": [ "7a07b517a5302a7ffd8b1151b81869e7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 405 }, "ua_disagreement": false } }, { "hash": "t13d221100_231e334592e8_ea4cbeb91c15", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d221100", "b": "231e334592e8", "c": "ea4cbeb91c15", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-51-49-23-65281-45-41,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789397356, "last_seen": 1789738879, "transport": "t", "ja3_hash": "253714f62c0a1e6869fe8ba6a45a0588", "ja3_variant_count": 1, "ja3_variants": [ "253714f62c0a1e6869fe8ba6a45a0588" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d2211h2_231e334592e8_7c0787dd9fe1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2211h2", "b": "231e334592e8", "c": "7c0787dd9fe1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-16-51-49-23-65281-45,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1789223338, "last_seen": 1789738881, "transport": "t", "ja3_hash": "8f6dd29dcbedf04835eb38c37abca624", "ja3_variant_count": 1, "ja3_variants": [ "8f6dd29dcbedf04835eb38c37abca624" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 96, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d2212h2_231e334592e8_a342e66d9b48", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2212h2", "b": "231e334592e8", "c": "a342e66d9b48", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-11-16-51-49-23-65281-45,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4676, "first_seen": 1787443418, "last_seen": 1789967981, "transport": "t", "ja3_hash": "a1180b5557791f9d36d36739d0d9b08a", "ja3_variant_count": 1, "ja3_variants": [ "a1180b5557791f9d36d36739d0d9b08a" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534+ (KHTML, like Gecko) BingPreview/1.0b": 16, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/136.0.0.0 Safari/537.36 AppleWebKit/537.36 (KHTML, like Gecko; ": 1010, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36": 4930 }, "ua_disagreement": false } }, { "hash": "t13d221300_a3988f242d56_5c37d630f182", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (5c37d630f182) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d221300", "b": "a3988f242d56", "c": "5c37d630f182", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49200-49196-49199-49195-159-158-57-136-51-49172-49171-69-49161-49162-132-53-65-47,65281-0-11-10-35-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 21, "first_seen": 1788324774, "last_seen": 1788858460, "transport": "t", "ja3_hash": "cbec769fa50b19be5dd9c627a8a27d1b", "ja3_variant_count": 1, "ja3_variants": [ "cbec769fa50b19be5dd9c627a8a27d1b" ], "user_agents": { "Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; +info@netcraft.com)": 11, "Mozilla/4.0 (compatible; Netcraft Web Server Survey)": 10 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d2213h2_231e334592e8_05b94552854b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2213h2", "b": "231e334592e8", "c": "05b94552854b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-11-16-51-49-23-65281-45-41,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 144, "first_seen": 1787454118, "last_seen": 1789949150, "transport": "t", "ja3_hash": "e073a34f05d77085eb938b316a570589", "ja3_variant_count": 1, "ja3_variants": [ "e073a34f05d77085eb938b316a570589" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36": 247, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/136.0.0.0 Safari/537.36 AppleWebKit/537.36 (KHTML, like Gecko; ": 231 }, "ua_disagreement": false } }, { "hash": "t13d241100_df98b6d6dfe4_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d241100", "b": "df98b6d6dfe4", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 24, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-52393-52392-49195-49199-49188-49192-49187-49191-49162-49172-49161-49171-157-156-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788885422, "last_seen": 1788902140, "transport": "t", "ja3_hash": "3353901e5dcb7720211753cebdaa087f", "ja3_variant_count": 1, "ja3_variants": [ "3353901e5dcb7720211753cebdaa087f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d241200_e4d65112872d_80a66a7241b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (80a66a7241b6) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d241200", "b": "e4d65112872d", "c": "80a66a7241b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 24, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49195-49199-158-52393-52392-49162-49172-57-49161-49171-51-156-53-47-49200-49196-61-106-56-50-255,0-11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787488240, "last_seen": 1789907276, "transport": "t", "ja3_hash": "f1b9b751b665449f1ce77721b0487b69", "ja3_variant_count": 1, "ja3_variants": [ "f1b9b751b665449f1ce77721b0487b69" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d251100_b78ed14e2fd0_4b7cee5f0569", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d251100", "b": "b78ed14e2fd0", "c": "4b7cee5f0569", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 25, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 409, "first_seen": 1787450482, "last_seen": 1789933178, "transport": "t", "ja3_hash": "99c071c5a5e14cc2527c9e8e0dde4a50", "ja3_variant_count": 4, "ja3_variants": [ "99c071c5a5e14cc2527c9e8e0dde4a50", "238bcebdfa16aa0be417a7f7a80063a9", "7916980d74f734e3cce90212ba1f5e2a", "bfd0c1ee9f8821c672b82328bf04183e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.6.25": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 2, "RootEvidence/1.0": 58, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.7.5 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_5_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.7922.112 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 3, "domain-harvester/dev (+https://github.com/esc-city/domain-harvester)": 24, "Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d2512h2_b78ed14e2fd0_36b6e4cc52f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2512h2", "b": "b78ed14e2fd0", "c": "36b6e4cc52f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 25, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 68, "first_seen": 1787464628, "last_seen": 1789868667, "transport": "t", "ja3_hash": "d6627faa72aa91c9e2ae51d456173c69", "ja3_variant_count": 1, "ja3_variants": [ "d6627faa72aa91c9e2ae51d456173c69" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0": 56, "Mozilla/5.0 (compatible; wpbot/1.4; +https://forms.gle/ajBaxygz9jSR8p8G9)": 25 }, "ua_disagreement": false } }, { "hash": "t13d260900_6d1bcf7a4624_1c00b73368e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d260900", "b": "6d1bcf7a4624", "c": "1c00b73368e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 26, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49195-49196-49187-49188-49161-49162-49200-49199-49171-49172-49191-49192-157-156-53-47-159-158-107-103-57-51-255,0-11-10-5-23-13-43-45-51,23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 252, "first_seen": 1787550998, "last_seen": 1789755945, "transport": "t", "ja3_hash": "de62b1c1a1860dded17275e0b45978bf", "ja3_variant_count": 1, "ja3_variants": [ "de62b1c1a1860dded17275e0b45978bf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 154, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 42 }, "ua_disagreement": false } }, { "hash": "t13d2610h2_6d1bcf7a4624_44417bcab4c7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2610h2", "b": "6d1bcf7a4624", "c": "44417bcab4c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 26, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49196-49187-49188-49161-49162-49200-49199-49171-49172-49191-49192-157-156-53-47-159-158-107-103-57-51-255,0-11-10-5-16-23-13-43-45-51,23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 14, "first_seen": 1788245275, "last_seen": 1789552641, "transport": "t", "ja3_hash": "fc061a05f1ac1f02645670f181e02e37", "ja3_variant_count": 1, "ja3_variants": [ "fc061a05f1ac1f02645670f181e02e37" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 62, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 70 }, "ua_disagreement": false } }, { "hash": "t13d2613h2_2802a3db6c62_87f4314a3231", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2613h2", "b": "2802a3db6c62", "c": "87f4314a3231", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 26, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49195-49188-49187-49162-49161-52393-49200-49199-49192-49191-49172-49171-52392-157-156-61-60-53-47-49160-49170-10,65281-0-23-13-5-18-16-11-51-45-43-10-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 21, "first_seen": 1787456794, "last_seen": 1789840447, "transport": "t", "ja3_hash": "6fa3244afc6bb6f9fad207b6b52af26b", "ja3_variant_count": 2, "ja3_variants": [ "6fa3244afc6bb6f9fad207b6b52af26b", "656b9a2f4de6ed4909e157482860ab3d" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1": 3, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.3 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13d271200_c42a7efa14d1_665d54402951", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d271200", "b": "c42a7efa14d1", "c": "665d54402951", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-5-22-23-13-43-45-51,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789799640, "last_seen": 1789802941, "transport": "t", "ja3_hash": "34afa12d10b640211cbf67c4af08a5a8", "ja3_variant_count": 1, "ja3_variants": [ "34afa12d10b640211cbf67c4af08a5a8" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; GeedoShopProductFinder) Chrome/142.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d2712h2_b4f9224df7c1_84ae619bfcdc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2712h2", "b": "b4f9224df7c1", "c": "84ae619bfcdc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-60-61-49188-49192-51-57-103-107-158-159-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-16-13-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1787832862, "last_seen": 1789948501, "transport": "t", "ja3_hash": "35c61a611436bd206b042c36810d36ad", "ja3_variant_count": 1, "ja3_variants": [ "35c61a611436bd206b042c36810d36ad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d2712h2_bd9791dd9fd6_c4728683d87f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2712h2", "b": "bd9791dd9fd6", "c": "c4728683d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,65281-0-11-10-35-16-22-23-13-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 24, "first_seen": 1788490741, "last_seen": 1789930705, "transport": "t", "ja3_hash": "d9f2482281395ce985f6d857e69e64c4", "ja3_variant_count": 2, "ja3_variants": [ "d9f2482281395ce985f6d857e69e64c4", "c2185c98088330cdff0145dcfce4f50b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d271300_c42a7efa14d1_439777fa9f13", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d271300", "b": "c42a7efa14d1", "c": "439777fa9f13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-5-22-23-13-43-45-51-27,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1789798648, "last_seen": 1789803082, "transport": "t", "ja3_hash": "a1f1aa95d7822b9eb6dda74301f2d31d", "ja3_variant_count": 1, "ja3_variants": [ "a1f1aa95d7822b9eb6dda74301f2d31d" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; GeedoShopProductFinder) Chrome/142.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d2713h2_bd9791dd9fd6_99c94103f5e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2713h2", "b": "bd9791dd9fd6", "c": "99c94103f5e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,65281-0-11-10-35-16-22-23-13-43-45-51-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 311, "first_seen": 1788477234, "last_seen": 1789931488, "transport": "t", "ja3_hash": "884e316eab85b7ebf649b54ededca3a6", "ja3_variant_count": 2, "ja3_variants": [ "884e316eab85b7ebf649b54ededca3a6", "c914b1b03e730d6324212d0e6e2103f5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 74, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 51, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 12 }, "ua_disagreement": false } }, { "hash": "t13d2713h2_c42a7efa14d1_567d8c15e8cd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2713h2", "b": "c42a7efa14d1", "c": "567d8c15e8cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789311811, "last_seen": 1789915878, "transport": "t", "ja3_hash": "7a12f1c2001593911ef85ba1beca892c", "ja3_variant_count": 1, "ja3_variants": [ "7a12f1c2001593911ef85ba1beca892c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d271400_c42a7efa14d1_468dee8d67d2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d271400", "b": "c42a7efa14d1", "c": "468dee8d67d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-5-22-23-13-43-45-51-27-41,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 35, "first_seen": 1789798672, "last_seen": 1789803186, "transport": "t", "ja3_hash": "aa2a482eb0209d2d01798b499241cd56", "ja3_variant_count": 1, "ja3_variants": [ "aa2a482eb0209d2d01798b499241cd56" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; GeedoShopProductFinder) Chrome/142.0.0.0 Safari/537.36": 35 }, "ua_disagreement": false } }, { "hash": "t13d2812h2_257f3020b3a2_84ae619bfcdc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2812h2", "b": "257f3020b3a2", "c": "84ae619bfcdc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 28, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-60-61-49161-49171-49162-49172-49187-49188-49192-156-157-47-53-51-57-103-107-158-159,0-23-65281-10-11-35-16-13-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1787626686, "last_seen": 1789889711, "transport": "t", "ja3_hash": "c3c1610cb4fbc856ed4f0652eddd3288", "ja3_variant_count": 1, "ja3_variants": [ "c3c1610cb4fbc856ed4f0652eddd3288" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d2812ht_6556f861e3c3_6c7c91134a62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2812ht", "b": "6556f861e3c3", "c": "6c7c91134a62", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 28, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-69-51-57-49196-49200-49327-49325-49195-49199-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-136-163-159-162-158-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788704578, "last_seen": 1788704578, "transport": "t", "ja3_hash": "a08bffbd0f7d6823739ed71f8460aaa2", "ja3_variant_count": 1, "ja3_variants": [ "a08bffbd0f7d6823739ed71f8460aaa2" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/124.0.6367.88 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d291300_723694b0fccc_c944148a3ac7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d291300", "b": "723694b0fccc", "c": "c944148a3ac7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 29, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-52393-49162-49325-49195-49161-49324-49200-52392-49172-49199-49171-157-53-49309-156-47-49308-159-52394-57-49311-158-51-49310,5-10-11-13-22-23-35-51-43-65281-0-45-28,23-24-25-29-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789265860, "last_seen": 1789361961, "transport": "t", "ja3_hash": "dc77af0fe75a1f6074c71845f8d49230", "ja3_variant_count": 1, "ja3_variants": [ "dc77af0fe75a1f6074c71845f8d49230" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d301000_1d37bd780c83_2038e8b55db5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301000", "b": "1d37bd780c83", "c": "2038e8b55db5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787625389, "last_seen": 1788827775, "transport": "t", "ja3_hash": "000f09ddfa6bb524e9b0c07931ddb084", "ja3_variant_count": 1, "ja3_variants": [ "000f09ddfa6bb524e9b0c07931ddb084" ], "user_agents": { "YelpBot (https://www.yelp.com/)": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d301000_1d37bd780c83_389a908827a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301000", "b": "1d37bd780c83", "c": "389a908827a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-22-23-13-43-45-51-0,4588-4587-4590-29-23-30-24-25-41-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4590, "name": "4590 (0x11ee)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 102, "first_seen": 1787454424, "last_seen": 1789924952, "transport": "t", "ja3_hash": "33ae362844509ccb28660da3cbfca03d", "ja3_variant_count": 1, "ja3_variants": [ "33ae362844509ccb28660da3cbfca03d" ], "user_agents": { "Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 45, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2, "Scrapy/2.17.0 (+https://scrapy.org)": 11 }, "ua_disagreement": false } }, { "hash": "t13d301100_1d37bd780c83_43412d48a437", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301100", "b": "1d37bd780c83", "c": "43412d48a437", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787832169, "last_seen": 1789456582, "transport": "t", "ja3_hash": "039a83a63c9eb5abb4c270206a9faa9d", "ja3_variant_count": 1, "ja3_variants": [ "039a83a63c9eb5abb4c270206a9faa9d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3": 32 }, "ua_disagreement": false } }, { "hash": "t13d301100_1d37bd780c83_6ecbdee5c734", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (6ecbdee5c734) with 2 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d301100", "b": "1d37bd780c83", "c": "6ecbdee5c734", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 709, "first_seen": 1787468471, "last_seen": 1789949210, "transport": "t", "ja3_hash": "27718d56688425cd36a401c66147c4ee", "ja3_variant_count": 2, "ja3_variants": [ "27718d56688425cd36a401c66147c4ee", "0b85eb0d4981e69064e40753e4f0ac5f" ], "user_agents": { "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; I": 1, "SeltzSitemapFetcher/1.0": 238 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d301200_1d37bd780c83_5cffa70d1141", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301200", "b": "1d37bd780c83", "c": "5cffa70d1141", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 29, "first_seen": 1787710540, "last_seen": 1789957767, "transport": "t", "ja3_hash": "eb4b4551f2c04f27c13b2cac537d42ff", "ja3_variant_count": 1, "ja3_variants": [ "eb4b4551f2c04f27c13b2cac537d42ff" ], "user_agents": { "Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.4a) Gecko/20030401": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15": 3, "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030516 Mozilla Firebird/0.6": 3 }, "ua_disagreement": false } }, { "hash": "t13d3012h2_1d37bd780c83_be43a87a1363", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3012h2", "b": "1d37bd780c83", "c": "be43a87a1363", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4874, "first_seen": 1787442706, "last_seen": 1789968418, "transport": "t", "ja3_hash": "446fb8bd613d17e5d44bd3b288ac94ca", "ja3_variant_count": 2, "ja3_variants": [ "446fb8bd613d17e5d44bd3b288ac94ca", "db8a6f4f9f8195ea17db377175d2cb08" ], "user_agents": { "curl/8.22.0-rc2": 2, "Mozilla/5.0 verrou-PQC-Scanner/1.15.0": 5, "Mozilla/5.0 ": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 149, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 SecurityHeaders": 4293, "pqcrypta-ip-update/1.0 (us-midwest heartbeat)": 365 }, "ua_disagreement": true } }, { "hash": "t13d3012h2_1d37bd780c83_c4728683d87f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3012h2", "b": "1d37bd780c83", "c": "c4728683d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1627, "first_seen": 1787448615, "last_seen": 1789913690, "transport": "t", "ja3_hash": "bb4bfd0ec15f5be2c4225880b93a8b18", "ja3_variant_count": 1, "ja3_variants": [ "bb4bfd0ec15f5be2c4225880b93a8b18" ], "user_agents": { "oh-llama/1.0": 2, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; SleepBot/1.0; +http://sleepbot.com/) Chrome/131.0.0.0 Safari/537.36": 1722, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d301300_1d37bd780c83_2b0ed48f4b04", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301300", "b": "1d37bd780c83", "c": "2b0ed48f4b04", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788470758, "last_seen": 1788470758, "transport": "t", "ja3_hash": "0ac7324a79776481ebbd4ad3c0a7860b", "ja3_variant_count": 1, "ja3_variants": [ "0ac7324a79776481ebbd4ad3c0a7860b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d301300_1d37bd780c83_39ecddd7b55d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301300", "b": "1d37bd780c83", "c": "39ecddd7b55d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-49-13-43-45-51-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 81, "first_seen": 1787710544, "last_seen": 1789957771, "transport": "t", "ja3_hash": "09070c12b765f9c0775d04ed2eadeb24", "ja3_variant_count": 1, "ja3_variants": [ "09070c12b765f9c0775d04ed2eadeb24" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/121.0": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.2210.133": 40 }, "ua_disagreement": false } }, { "hash": "t13d301300_1d37bd780c83_4271f981cf51", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301300", "b": "1d37bd780c83", "c": "4271f981cf51", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 262, "first_seen": 1787463369, "last_seen": 1789959292, "transport": "t", "ja3_hash": "9524fdc98d5b2c3efd160e8906158fa8", "ja3_variant_count": 1, "ja3_variants": [ "9524fdc98d5b2c3efd160e8906158fa8" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 178, "SoonBot/1.0 (+https://soon.ciaransplayground.com)": 4, "Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0": 77 }, "ua_disagreement": false } }, { "hash": "t13d3014ht_1d37bd780c83_8e6e8e92acc7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3014ht", "b": "1d37bd780c83", "c": "8e6e8e92acc7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787639871, "last_seen": 1789408852, "transport": "t", "ja3_hash": "4e2cfcb0773f3ec8e6ff59727c11f4f7", "ja3_variant_count": 1, "ja3_variants": [ "4e2cfcb0773f3ec8e6ff59727c11f4f7" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124 Safari/537.36": 18, "tld-netprobe/1.0 (+CONTACT-URL-UNSET-see-DECISIONS-D8)": 4 }, "ua_disagreement": false } }, { "hash": "t13d311000_e8f1e7e78f70_3e0748a2ed56", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311000", "b": "e8f1e7e78f70", "c": "3e0748a2ed56", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787911063, "last_seen": 1789947559, "transport": "t", "ja3_hash": "49e76101e93ff7ad65a47925a25c2cff", "ja3_variant_count": 1, "ja3_variants": [ "49e76101e93ff7ad65a47925a25c2cff" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d311000_e8f1e7e78f70_60527930a971", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311000", "b": "e8f1e7e78f70", "c": "60527930a971", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 251, "first_seen": 1787551529, "last_seen": 1789935927, "transport": "t", "ja3_hash": "a3afc2c46ba4a7d7fbe1cfb7a3031c2f", "ja3_variant_count": 1, "ja3_variants": [ "a3afc2c46ba4a7d7fbe1cfb7a3031c2f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 YaBrowser/25.4.0.0 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d311100_1d947a95fc68_95845176f41a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311100", "b": "1d947a95fc68", "c": "95845176f41a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-13-50-17-23-43-45-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787552552, "last_seen": 1789877407, "transport": "t", "ja3_hash": "3b1a95acc8030a741dbf6d54b2b67b71", "ja3_variant_count": 1, "ja3_variants": [ "3b1a95acc8030a741dbf6d54b2b67b71" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/600.3.18 (KHTML, like Gecko) Version/8.0.3 Safari/600.3.18": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d311100_e8f1e7e78f70_173082c9b150", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311100", "b": "e8f1e7e78f70", "c": "173082c9b150", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 132, "first_seen": 1787492935, "last_seen": 1789915444, "transport": "t", "ja3_hash": "c199b43d41b470f8f68c5561f8f1ce3e", "ja3_variant_count": 1, "ja3_variants": [ "c199b43d41b470f8f68c5561f8f1ce3e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36": 120, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d311100_e8f1e7e78f70_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311100", "b": "e8f1e7e78f70", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1569, "first_seen": 1787445940, "last_seen": 1789959926, "transport": "t", "ja3_hash": "d39e1be3241d516b1f714bd47c2bc968", "ja3_variant_count": 1, "ja3_variants": [ "d39e1be3241d516b1f714bd47c2bc968" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/126 Safari/537.36": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 14, "Mozilla/5.0 (compatible; CT-WP-Probe/1.2)": 6 }, "ua_disagreement": false } }, { "hash": "t13d311100_e8f1e7e78f70_d5a215a6b957", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311100", "b": "e8f1e7e78f70", "c": "d5a215a6b957", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-13172-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788924254, "last_seen": 1788924254, "transport": "t", "ja3_hash": "71b34f414018bd096ecc05c22b4630c6", "ja3_variant_count": 1, "ja3_variants": [ "71b34f414018bd096ecc05c22b4630c6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d311100_e8f1e7e78f70_ea55c5214f7d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311100", "b": "e8f1e7e78f70", "c": "ea55c5214f7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-158-49188-49192-49187-49191-107-103-49162-49172-49161-49171-57-51-157-156-61-60-53-47-255,0-5-10-11-13-50-17-23-43-45-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789181038, "last_seen": 1789300235, "transport": "t", "ja3_hash": "f3bacacdad014062f21b944423053cda", "ja3_variant_count": 1, "ja3_variants": [ "f3bacacdad014062f21b944423053cda" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d3111h2_e8f1e7e78f70_43244b3c42a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3111h2", "b": "e8f1e7e78f70", "c": "43244b3c42a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-16-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 54884, "first_seen": 1787444780, "last_seen": 1789968421, "transport": "t", "ja3_hash": "1ce565f411fbc7412e3c5ba0bcfd62ab", "ja3_variant_count": 1, "ja3_variants": [ "1ce565f411fbc7412e3c5ba0bcfd62ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.faceb": 16209, "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)": 534, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.co": 30710 }, "ua_disagreement": true } }, { "hash": "t13d311200_1d947a95fc68_30b414fd2f42", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311200", "b": "1d947a95fc68", "c": "30b414fd2f42", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 17427, "first_seen": 1787443052, "last_seen": 1789968438, "transport": "t", "ja3_hash": "adbab9d5752f7c834ec405ec92e46415", "ja3_variant_count": 2, "ja3_variants": [ "adbab9d5752f7c834ec405ec92e46415", "6a61e40083a0978aac19a7bd5aad9a19" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36": 215, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_3_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.17 Safari/537.36": 49, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.69 Safari/537.36": 40 }, "ua_disagreement": false } }, { "hash": "t13d311200_e8f1e7e78f70_136ffa00a224", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311200", "b": "e8f1e7e78f70", "c": "136ffa00a224", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 33, "first_seen": 1788503621, "last_seen": 1789536947, "transport": "t", "ja3_hash": "86d37534033d9c5b60a83ff8b2fbeea3", "ja3_variant_count": 1, "ja3_variants": [ "86d37534033d9c5b60a83ff8b2fbeea3" ], "user_agents": { "Ruby": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36": 27 }, "ua_disagreement": false } }, { "hash": "t13d311200_e8f1e7e78f70_5db088831031", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311200", "b": "e8f1e7e78f70", "c": "5db088831031", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-49-13-43-45-51-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789536938, "last_seen": 1789536938, "transport": "t", "ja3_hash": "6f9acb2c779756ec4cf50428532f9896", "ja3_variant_count": 1, "ja3_variants": [ "6f9acb2c779756ec4cf50428532f9896" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36": 22 }, "ua_disagreement": false } }, { "hash": "t13d3112ht_e8f1e7e78f70_450ee2175630", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112ht", "b": "e8f1e7e78f70", "c": "450ee2175630", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-13172-16-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788410865, "last_seen": 1788908939, "transport": "t", "ja3_hash": "456523fc94726331a4d5a2e1d40b2cd7", "ja3_variant_count": 1, "ja3_variants": [ "456523fc94726331a4d5a2e1d40b2cd7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d311300_1d947a95fc68_0f7785612353", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311300", "b": "1d947a95fc68", "c": "0f7785612353", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-17-23-35-13-43-45-50-51-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 61, "first_seen": 1787531208, "last_seen": 1789456335, "transport": "t", "ja3_hash": "57128db24fb3c2fc035d6a39ccb08cac", "ja3_variant_count": 1, "ja3_variants": [ "57128db24fb3c2fc035d6a39ccb08cac" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (compatible; heritrix/3.14.2-SNAPSHOT-2026-04-13T06:21:22Z +https://www.image-meta.com)": 35, "Mozilla/5.0 (compatible; SEOkicks; +https://www.seokicks.de/robot.html)": 4 }, "ua_disagreement": false } }, { "hash": "t13d3113h2_e8f1e7e78f70_2cdd36f09136", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3113h2", "b": "e8f1e7e78f70", "c": "2cdd36f09136", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-13172-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 608, "first_seen": 1787487114, "last_seen": 1789967292, "transport": "t", "ja3_hash": "f436b9416f37d134cadd04886327d3e8", "ja3_variant_count": 1, "ja3_variants": [ "f436b9416f37d134cadd04886327d3e8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0": 123, "Mozilla/5.0 (Linux; Android 8.0.0; ATU-L11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Mobile Safari/537.36": 2, "Mozilla/5.0 (Linux; arm; Android 9; SM-J400F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 YaApp_Android/10.63 YaSearchBrowser/10.63 BroPP/1.0 SA/1 Mobile Safari/537": 33 }, "ua_disagreement": false } }, { "hash": "t13d3113h2_e8f1e7e78f70_6fab81fbbddb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3113h2", "b": "e8f1e7e78f70", "c": "6fab81fbbddb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-13172-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 71, "first_seen": 1787642803, "last_seen": 1789825255, "transport": "t", "ja3_hash": "4ea056e63b7910cbf543f0c095064dfe", "ja3_variant_count": 1, "ja3_variants": [ "4ea056e63b7910cbf543f0c095064dfe" ], "user_agents": { "Slackbot 1.0 (+https://api.slack.com/robots)": 30, "Slackbot-LinkExpanding 1.0 (+https://api.slack.com/robots)": 13, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d3113h2_e8f1e7e78f70_b9cf1a435647", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3113h2", "b": "e8f1e7e78f70", "c": "b9cf1a435647", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-158-49188-49192-49187-49191-107-103-49162-49172-49161-49171-57-51-157-156-61-60-53-47-255,0-5-10-11-16-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789798586, "last_seen": 1789944340, "transport": "t", "ja3_hash": "6cdcd76c031562f861291a0d61a9d9b0", "ja3_variant_count": 1, "ja3_variants": [ "6cdcd76c031562f861291a0d61a9d9b0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; SM-G981B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.162 Mobile Safari/537.36": 2, "Mozilla/5.0 (compatible; Dataprovider.com)": 32 }, "ua_disagreement": false } }, { "hash": "t13d3113ht_e8f1e7e78f70_6b9dd2e5c643", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3113ht", "b": "e8f1e7e78f70", "c": "6b9dd2e5c643", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 71, "first_seen": 1787718415, "last_seen": 1789803078, "transport": "t", "ja3_hash": "46531b76d4d69e9c86d481cf71fa4933", "ja3_variant_count": 1, "ja3_variants": [ "46531b76d4d69e9c86d481cf71fa4933" ], "user_agents": { "Mozilla/5.0 (compatible; PisarBot/1.0)": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 28, "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:31.0) Gecko/20100101 Firefox/31.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d321000_b7b92d878678_0308b505d65b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d321000", "b": "b7b92d878678", "c": "0308b505d65b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 32, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49172-57-49171-51-157-156-61-60-53-47-154-153-150-255,0-11-10-35-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 22, "first_seen": 1789566374, "last_seen": 1789568246, "transport": "t", "ja3_hash": "d0cb9fd7e9ac1d5a44285d06b3833dc2", "ja3_variant_count": 1, "ja3_variants": [ "d0cb9fd7e9ac1d5a44285d06b3833dc2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 233 }, "ua_disagreement": false } }, { "hash": "t13d330900_80cecea31fe6_295fbc80e014", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d330900", "b": "80cecea31fe6", "c": "295fbc80e014", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 33, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-157-156-61-60-53-47-255,0-10-11-13-50-23-43-45-51,23-24-25-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789043203, "last_seen": 1789043209, "transport": "t", "ja3_hash": "5bc54a041cd6063568c95e70de1d4bc6", "ja3_variant_count": 1, "ja3_variants": [ "5bc54a041cd6063568c95e70de1d4bc6" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13d340900_832bd7ce3ea2_b229174c0316", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d340900", "b": "832bd7ce3ea2", "c": "b229174c0316", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 34, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-52393-52392-49195-49199-49196-49200-158-159-49187-49191-49161-49192-49171-49188-49162-49172-103-51-107-57-49160-49170-22-156-157-60-61-47-53-10-255,0-11-10-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788463575, "last_seen": 1788463575, "transport": "t", "ja3_hash": "04f1408fbaed687e2510afff7ea52fdf", "ja3_variant_count": 1, "ja3_variants": [ "04f1408fbaed687e2510afff7ea52fdf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 19 }, "ua_disagreement": false } }, { "hash": "t13d3512ht_bfa337485184_791d1759074c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3512ht", "b": "bfa337485184", "c": "791d1759074c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-16-22-23-49-13-43-45-51,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788833869, "last_seen": 1788833869, "transport": "t", "ja3_hash": "f919ef172bfa751d8355985fbf154b3c", "ja3_variant_count": 1, "ja3_variants": [ "f919ef172bfa751d8355985fbf154b3c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d351300_bfa337485184_5c37d630f182", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d351300", "b": "bfa337485184", "c": "5c37d630f182", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787893160, "last_seen": 1788470882, "transport": "t", "ja3_hash": "89df856fbed53b06863adb3e3d27c505", "ja3_variant_count": 1, "ja3_variants": [ "89df856fbed53b06863adb3e3d27c505" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d3513ht_bfa337485184_567d8c15e8cd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3513ht", "b": "bfa337485184", "c": "567d8c15e8cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788332712, "last_seen": 1788845796, "transport": "t", "ja3_hash": "42cb4ba4c818da3ce6424cb212377c24", "ja3_variant_count": 1, "ja3_variants": [ "42cb4ba4c818da3ce6424cb212377c24" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 7, "URLBuilder/2.0 (research crawler; set a contact address here)": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d351400_bfa337485184_3db6827a426b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d351400", "b": "bfa337485184", "c": "3db6827a426b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-5-22-23-13-43-45-51-27-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 93, "first_seen": 1789798344, "last_seen": 1789804280, "transport": "t", "ja3_hash": "caf8598cced3c5a2cee76e5f2f4e5e1f", "ja3_variant_count": 1, "ja3_variants": [ "caf8598cced3c5a2cee76e5f2f4e5e1f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; GeedoShopProductFinder) Chrome/142.0.0.0 Safari/537.36": 93 }, "ua_disagreement": false } }, { "hash": "t13d361000_bcee18a5b459_389a908827a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (389a908827a0) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d361000", "b": "bcee18a5b459", "c": "389a908827a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49188-49192-49162-49172-49311-107-57-49324-49187-49191-49161-49171-49310-103-51-157-156-49309-49308-61-60-53-47,65281-11-10-22-23-13-43-45-51-0,4588-4587-4590-29-23-30-24-25-41-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4590, "name": "4590 (0x11ee)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788155907, "last_seen": 1789691988, "transport": "t", "ja3_hash": "b86120d79287048bf5f46a2992b514cb", "ja3_variant_count": 1, "ja3_variants": [ "b86120d79287048bf5f46a2992b514cb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2)": 4 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d361100_018971650b2c_c4bb350abab6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d361100", "b": "018971650b2c", "c": "c4bb350abab6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789231360, "last_seen": 1789231366, "transport": "t", "ja3_hash": "58b4a68113f964e19d977ee28575751a", "ja3_variant_count": 1, "ja3_variants": [ "58b4a68113f964e19d977ee28575751a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d3612ht_018971650b2c_2b7f4d1bb443", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3612ht", "b": "018971650b2c", "c": "2b7f4d1bb443", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 76, "first_seen": 1787455749, "last_seen": 1789966408, "transport": "t", "ja3_hash": "329b565abdf75223103131e11ead4844", "ja3_variant_count": 1, "ja3_variants": [ "329b565abdf75223103131e11ead4844" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d3612ht_018971650b2c_f7fc4ab940eb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3612ht", "b": "018971650b2c", "c": "f7fc4ab940eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 102, "first_seen": 1787445558, "last_seen": 1789911207, "transport": "t", "ja3_hash": "8ecd69af8e3262389176342e8165854e", "ja3_variant_count": 1, "ja3_variants": [ "8ecd69af8e3262389176342e8165854e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 98 }, "ua_disagreement": false } }, { "hash": "t13d3612ht_bcee18a5b459_be43a87a1363", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3612ht", "b": "bcee18a5b459", "c": "be43a87a1363", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47,65281-0-11-10-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 33, "first_seen": 1787591574, "last_seen": 1789631356, "transport": "t", "ja3_hash": "8330c8aa169a0da87d80ccca42b6120a", "ja3_variant_count": 1, "ja3_variants": [ "8330c8aa169a0da87d80ccca42b6120a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Mobile Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d3612ht_bcee18a5b459_c4728683d87f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3612ht", "b": "bcee18a5b459", "c": "c4728683d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789181637, "last_seen": 1789188328, "transport": "t", "ja3_hash": "03c748105a5436f58503314629577ec1", "ja3_variant_count": 1, "ja3_variants": [ "03c748105a5436f58503314629577ec1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.3707.700 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.6096.198 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.6122.323 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d3613ht_018971650b2c_1b4599a2a42a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3613ht", "b": "018971650b2c", "c": "1b4599a2a42a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,0-11-10-16-22-23-49-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787882293, "last_seen": 1789593171, "transport": "t", "ja3_hash": "1ee96c96da0a44dc79c063f3d88105f5", "ja3_variant_count": 1, "ja3_variants": [ "1ee96c96da0a44dc79c063f3d88105f5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d3613ht_018971650b2c_61d75ce65702", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3613ht", "b": "018971650b2c", "c": "61d75ce65702", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,0-11-10-13172-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788970558, "last_seen": 1788970558, "transport": "t", "ja3_hash": "e690df036922288311144cc96acf6515", "ja3_variant_count": 1, "ja3_variants": [ "e690df036922288311144cc96acf6515" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3": 1 }, "ua_disagreement": false } }, { "hash": "t13d3613ht_bcee18a5b459_23c7dd8c4d5c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3613ht", "b": "bcee18a5b459", "c": "23c7dd8c4d5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 9, "first_seen": 1787695629, "last_seen": 1789764689, "transport": "t", "ja3_hash": "114a5a24bfd39d2e70adabd3a205029f", "ja3_variant_count": 1, "ja3_variants": [ "114a5a24bfd39d2e70adabd3a205029f" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0 Safari/537.36": 4, "python-requests/2.32.3": 2 }, "ua_disagreement": true } }, { "hash": "t13d3614ht_bcee18a5b459_ed8524ea7a97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3614ht", "b": "bcee18a5b459", "c": "ed8524ea7a97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47,65281-0-11-10-35-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 24, "first_seen": 1787864846, "last_seen": 1789862900, "transport": "t", "ja3_hash": "42f276190a111f16589fafca4399a9d6", "ja3_variant_count": 1, "ja3_variants": [ "42f276190a111f16589fafca4399a9d6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d371200_db35923f8641_f0d148687978", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d371200", "b": "db35923f8641", "c": "f0d148687978", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 37, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-157-156-61-60-53-47-255,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 19, "first_seen": 1788654174, "last_seen": 1789569681, "transport": "t", "ja3_hash": "0a0d72200639a7a39887b9d81a247310", "ja3_variant_count": 1, "ja3_variants": [ "0a0d72200639a7a39887b9d81a247310" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t13d371300_db35923f8641_fb34c6f268a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d371300", "b": "db35923f8641", "c": "fb34c6f268a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 37, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-157-156-61-60-53-47-255,0-5-10-11-17-23-35-13-43-45-50-51-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 33, "first_seen": 1788923185, "last_seen": 1789569684, "transport": "t", "ja3_hash": "a391c8ec005d3a6a8aafc394edf6c1c2", "ja3_variant_count": 1, "ja3_variants": [ "a391c8ec005d3a6a8aafc394edf6c1c2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 33 }, "ua_disagreement": false } }, { "hash": "t13d3811ht_d907d51a1673_4faf6fc70b6d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3811ht", "b": "d907d51a1673", "c": "4faf6fc70b6d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 38, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49171-49172-49161-49162-50-56-51-57-49191-49192-49199-49200-52392-49187-49188-49195-49196-52393-103-107-158-159-64-106-4-5-10-19-47-53-60-61-156-157-255,0-11-10-35-16-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 46, "first_seen": 1789158201, "last_seen": 1789158208, "transport": "t", "ja3_hash": "bff6a4467efb3b8eb8688abd7f120f8e", "ja3_variant_count": 1, "ja3_variants": [ "bff6a4467efb3b8eb8688abd7f120f8e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36": 51 }, "ua_disagreement": false } }, { "hash": "t13d4311ht_c7886603b240_d448f5ea0137", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d4311ht", "b": "c7886603b240", "c": "d448f5ea0137", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 43, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-16-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 80, "first_seen": 1788393661, "last_seen": 1789727335, "transport": "t", "ja3_hash": "1401686b7c2c7223309a4b924ae84ade", "ja3_variant_count": 1, "ja3_variants": [ "1401686b7c2c7223309a4b924ae84ade" ], "user_agents": { "Dalvik/2.1.0 (Linux; U; Android 9.0; ZTE BA520 Build/MRA58K)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.27 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/601.1.27": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36": 78 }, "ua_disagreement": false } }, { "hash": "t13d431200_c7886603b240_f6d223e2d5c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d431200", "b": "c7886603b240", "c": "f6d223e2d5c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 43, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788803519, "last_seen": 1789503057, "transport": "t", "ja3_hash": "5fb798ffef091e3699f344d0d0895792", "ja3_variant_count": 1, "ja3_variants": [ "5fb798ffef091e3699f344d0d0895792" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d4312ht_c7886603b240_d89d4c7b8e02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d4312ht", "b": "c7886603b240", "c": "d89d4c7b8e02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 43, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 720, "first_seen": 1787447973, "last_seen": 1789960505, "transport": "t", "ja3_hash": "07ff1e545ef8ab3fcf8a4dc9272221c2", "ja3_variant_count": 2, "ja3_variants": [ "07ff1e545ef8ab3fcf8a4dc9272221c2", "8d9f7747675e24454cd9b7ed35c58707" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 30, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36": 162, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1621, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0 Safari/537.36": 5, "Mozilla/5.096783921 Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko": 2 }, "ua_disagreement": false } }, { "hash": "t13d441200_fd39b124ee10_f6d223e2d5c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d441200", "b": "fd39b124ee10", "c": "f6d223e2d5c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 44, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787540039, "last_seen": 1789912843, "transport": "t", "ja3_hash": "7fa6c8a6bf61ccc693e36c73d8b45f41", "ja3_variant_count": 1, "ja3_variants": [ "7fa6c8a6bf61ccc693e36c73d8b45f41" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:126.0) Gecko/20100101 Firefox/126.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d4412ht_fd39b124ee10_e43cb171baa5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d4412ht", "b": "fd39b124ee10", "c": "e43cb171baa5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 44, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787944989, "last_seen": 1789947566, "transport": "t", "ja3_hash": "845e1f88500d1cc324a33807700cd21e", "ja3_variant_count": 1, "ja3_variants": [ "845e1f88500d1cc324a33807700cd21e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.58": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/114.0": 1, "Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d450900_d524c25c267f_295fbc80e014", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d450900", "b": "d524c25c267f", "c": "295fbc80e014", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 45, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-10-11-13-50-23-43-45-51,23-24-25-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5285, "first_seen": 1787442882, "last_seen": 1789967037, "transport": "t", "ja3_hash": "479b976148ec2a1a195ae2e15805fefa", "ja3_variant_count": 1, "ja3_variants": [ "479b976148ec2a1a195ae2e15805fefa" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36": 4839, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/8.0.2 Safari/600.2.5 (Gort)": 415, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/605.1.15": 16 }, "ua_disagreement": false } }, { "hash": "t13d491000_834380eab35e_7ef8eb972a3c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d491000", "b": "834380eab35e", "c": "7ef8eb972a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-163-159-162-158-52394-49327-49325-49188-49192-49162-49172-49315-49311-107-106-57-56-49326-49324-49187-49191-49161-49171-49314-49310-103-64-51-50-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 44, "first_seen": 1787717770, "last_seen": 1789786930, "transport": "t", "ja3_hash": "c3bd146e335e754c321db7baee4b2cf1", "ja3_variant_count": 1, "ja3_variants": [ "c3bd146e335e754c321db7baee4b2cf1" ], "user_agents": { "Mozilla/5.051975669 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36": 2, "Mozilla/5.0101097241 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36": 3, "Mozilla/5.066704189 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d4913h2_bd868743f55c_67923868ce16", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d4913h2", "b": "bd868743f55c", "c": "67923868ce16", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-5-10-11-16-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789608588, "last_seen": 1789656261, "transport": "t", "ja3_hash": "62f6a6727fda5a1104d5b147cd82e520", "ja3_variant_count": 1, "ja3_variants": [ "62f6a6727fda5a1104d5b147cd82e520" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d520900_7faecdd2bbb4_295fbc80e014", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d520900", "b": "7faecdd2bbb4", "c": "295fbc80e014", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-49160-49170-22-19-49155-49165-10-255,0-10-11-13-50-23-43-45-51,23-24-25-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789725417, "last_seen": 1789725417, "transport": "t", "ja3_hash": "087ee3566e951eff4a754d09329fa1c6", "ja3_variant_count": 1, "ja3_variants": [ "087ee3566e951eff4a754d09329fa1c6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/121.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d521100_b262b3658495_6ecbdee5c734", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d521100", "b": "b262b3658495", "c": "6ecbdee5c734", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 593, "first_seen": 1787500188, "last_seen": 1789914797, "transport": "t", "ja3_hash": "944d1e1858cd278718f8a46b65d3212f", "ja3_variant_count": 3, "ja3_variants": [ "944d1e1858cd278718f8a46b65d3212f", "b01117ea1f10cac905ca73e33a078c75", "0bfaf0ce57f1e5476668c0bcff35e70e" ], "user_agents": { "ArenaUnfurlBot/1.0 (Link preview bot for AI model comparison platform; +https://arena.ai) Mozilla/5.0 (compatible)": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36": 4, "FudgeResearchBot/1.0 (+https://design.withfudge.com; simdi@withfudge.com)": 5, "YisouSpider": 66, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d521200_b262b3658495_55ac72f97122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d521200", "b": "b262b3658495", "c": "55ac72f97122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788916050, "last_seen": 1789885419, "transport": "t", "ja3_hash": "8a6ffa496f0369be9fba044efee40f80", "ja3_variant_count": 1, "ja3_variants": [ "8a6ffa496f0369be9fba044efee40f80" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d521200_b262b3658495_b722ecb35a82", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d521200", "b": "b262b3658495", "c": "b722ecb35a82", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789360813, "last_seen": 1789360813, "transport": "t", "ja3_hash": "3071e91916919685206127280b6af9bf", "ja3_variant_count": 1, "ja3_variants": [ "3071e91916919685206127280b6af9bf" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d5212h2_b262b3658495_c4728683d87f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d5212h2", "b": "b262b3658495", "c": "c4728683d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 671, "first_seen": 1787510934, "last_seen": 1789966247, "transport": "t", "ja3_hash": "d67b094811e5145139d7cea5f014309f", "ja3_variant_count": 1, "ja3_variants": [ "d67b094811e5145139d7cea5f014309f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 24, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; BuiltWith/1.4; rb.gy/xprgqj) Chrome/124.0.0.0 Safari/537.36": 51, "FraunhoferSIT-DomainIntel/1.0 (domain measurement study; Fraunhofer Institute for Secure Information Technology SIT; contact: tobias.gattermayer@sit.fraunhofer.de)": 16 }, "ua_disagreement": false } }, { "hash": "t13d5212ht_b262b3658495_c4728683d87f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d5212ht", "b": "b262b3658495", "c": "c4728683d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1787669960, "last_seen": 1789629038, "transport": "t", "ja3_hash": "983846581fdb62fafdb21d2282592c57", "ja3_variant_count": 2, "ja3_variants": [ "983846581fdb62fafdb21d2282592c57", "1808993db60a053eb8ce0eb1c51750d6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Salesguy/1.0 (+https://salesguy.com/why)": 2, "favi.sh/1.0 (+https://favi.sh/legal/abuse; logo fetcher; contact abuse@favi.sh)": 2, "Mozilla/5.0 (compatible; ProductCandidate/0.1; +local-research)": 4, "Unite-ResolveUrl/1.0": 1, "Mozilla/5.0 (compatible; NewsltrBot/1.0; +https://www.newsltr.ca)": 1 }, "ua_disagreement": false } }, { "hash": "t13d5213ht_b262b3658495_64d09470ca3c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d5213ht", "b": "b262b3658495", "c": "64d09470ca3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1645, "first_seen": 1787759453, "last_seen": 1789609883, "transport": "t", "ja3_hash": "30490d79325943f1ebf6750aae4e304c", "ja3_variant_count": 1, "ja3_variants": [ "30490d79325943f1ebf6750aae4e304c" ], "user_agents": { "node": 16518, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (compatible; QlyzeBot/1.0; +https://app.qlyze.io/bot)": 26 }, "ua_disagreement": false } }, { "hash": "t13d531000_ed6c8d7875f9_60527930a971", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d531000", "b": "ed6c8d7875f9", "c": "60527930a971", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 53, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 12, "first_seen": 1787579687, "last_seen": 1789867027, "transport": "t", "ja3_hash": "84c5a0e20a05f30088adf77a111f86ba", "ja3_variant_count": 1, "ja3_variants": [ "84c5a0e20a05f30088adf77a111f86ba" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d591000_a33745022dd6_1075c442c310", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d591000", "b": "a33745022dd6", "c": "1075c442c310", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 59, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 24, "first_seen": 1787458673, "last_seen": 1789810231, "transport": "t", "ja3_hash": "0cce74b0d9b7f8528fb2181588d23793", "ja3_variant_count": 1, "ja3_variants": [ "0cce74b0d9b7f8528fb2181588d23793" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; ClaudeBot/1.0; +claudebot@anthropic.com)": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d5911ht_a33745022dd6_4086b72c8bfb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d5911ht", "b": "a33745022dd6", "c": "4086b72c8bfb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 59, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-16-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 145, "first_seen": 1787562965, "last_seen": 1789890767, "transport": "t", "ja3_hash": "1a28e69016765d92e3b381168d68922c", "ja3_variant_count": 1, "ja3_variants": [ "1a28e69016765d92e3b381168d68922c" ], "user_agents": { "mcpsee-observatory/0.1.0 (+https://mcpsee.com)": 80, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15": 2, "node": 319 }, "ua_disagreement": false } }, { "hash": "t13d5912ht_a33745022dd6_cc39e63c105f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d5912ht", "b": "a33745022dd6", "c": "cc39e63c105f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 59, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-16-22-23-13-43-45-51-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787576132, "last_seen": 1789437746, "transport": "t", "ja3_hash": "70cb5ca646080902703ffda87036a5ea", "ja3_variant_count": 1, "ja3_variants": [ "70cb5ca646080902703ffda87036a5ea" ], "user_agents": { "mcpsee-observatory/0.1.0 (+https://mcpsee.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 1, "node": 5 }, "ua_disagreement": false } }, { "hash": "t13d681100_13e0e9e1c501_6ecbdee5c734", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (6ecbdee5c734) with 2 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d681100", "b": "13e0e9e1c501", "c": "6ecbdee5c734", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 68, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-162-163-159-49191-49187-49171-49161-49192-49188-49172-49162-103-51-64-107-56-57-156-157-49324-49310-50-49308-60-47-49325-49311-106-49309-61-53-52393-52392-52394-49245-49249-49239-49235-49244-49248-49238-49234-49267-49271-196-195-49266-49270-190-189-136-135-69-68-49233-49232-192-186-132-65,65281-0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 186, "first_seen": 1787456529, "last_seen": 1789925077, "transport": "t", "ja3_hash": "8c62649fec22c17049a59e7d05c53484", "ja3_variant_count": 2, "ja3_variants": [ "8c62649fec22c17049a59e7d05c53484", "d1fbc036c01e61dd08a74292b08430d6" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d691000_8b2139ff7677_c77473ed3a43", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d691000", "b": "8b2139ff7677", "c": "c77473ed3a43", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51,4588-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789119250, "last_seen": 1789131808, "transport": "t", "ja3_hash": "fc01617548c3d00273cf57901ba5602a", "ja3_variant_count": 1, "ja3_variants": [ "fc01617548c3d00273cf57901ba5602a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13d691100_8b2139ff7677_35692a61e658", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d691100", "b": "8b2139ff7677", "c": "35692a61e658", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787810402, "last_seen": 1789629380, "transport": "t", "ja3_hash": "85ba585fa57b7a441a1b0dd6f2b85d90", "ja3_variant_count": 1, "ja3_variants": [ "85ba585fa57b7a441a1b0dd6f2b85d90" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 43 }, "ua_disagreement": false } }, { "hash": "t13d691100_8b2139ff7677_ac2311016557", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d691100", "b": "8b2139ff7677", "c": "ac2311016557", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51-41,29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 42, "first_seen": 1787810503, "last_seen": 1789629382, "transport": "t", "ja3_hash": "87e71c0467fafa13b2d8d0fea645a7d3", "ja3_variant_count": 2, "ja3_variants": [ "87e71c0467fafa13b2d8d0fea645a7d3", "7ada50d13957b8015fe585c0e38b5bc3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 127, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 1322 }, "ua_disagreement": false } }, { "hash": "t13d6911h2_8b2139ff7677_95bd209da7e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d6911h2", "b": "8b2139ff7677", "c": "95bd209da7e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-16-22-23-13-43-45-51,4588-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 11, "first_seen": 1789119252, "last_seen": 1789134603, "transport": "t", "ja3_hash": "a0da5209e1c60415f59eda3f2cd5e7fe", "ja3_variant_count": 1, "ja3_variants": [ "a0da5209e1c60415f59eda3f2cd5e7fe" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 466 }, "ua_disagreement": false } }, { "hash": "t13d691200_8b2139ff7677_0778cb588346", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d691200", "b": "8b2139ff7677", "c": "0778cb588346", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-5-22-23-13-43-45-51-21,29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 65, "first_seen": 1789120626, "last_seen": 1789552361, "transport": "t", "ja3_hash": "1700d1961c5836e896b9611a8a85713c", "ja3_variant_count": 1, "ja3_variants": [ "1700d1961c5836e896b9611a8a85713c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 84 }, "ua_disagreement": false } }, { "hash": "t13d6912h2_8b2139ff7677_c5ac172ddf95", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d6912h2", "b": "8b2139ff7677", "c": "c5ac172ddf95", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 118, "first_seen": 1787810399, "last_seen": 1789630875, "transport": "t", "ja3_hash": "24f150d25e5f0f4327e4f3e210bb89c8", "ja3_variant_count": 1, "ja3_variants": [ "24f150d25e5f0f4327e4f3e210bb89c8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 30, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d6912ht_8b2139ff7677_8f650188da36", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d6912ht", "b": "8b2139ff7677", "c": "8f650188da36", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-16-22-23-13-43-45-51-41,29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789458280, "last_seen": 1789484333, "transport": "t", "ja3_hash": "970a8f9cb1ad50badefb3538d0b3e3e1", "ja3_variant_count": 1, "ja3_variants": [ "970a8f9cb1ad50badefb3538d0b3e3e1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 22 }, "ua_disagreement": false } }, { "hash": "t13d6913h2_8b2139ff7677_123bc1990f87", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d6913h2", "b": "8b2139ff7677", "c": "123bc1990f87", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-5-16-22-23-13-43-45-51-21,29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 90, "first_seen": 1789120629, "last_seen": 1789553585, "transport": "t", "ja3_hash": "4f9b0e26fc64e24476d5a62fed9b04d1", "ja3_variant_count": 1, "ja3_variants": [ "4f9b0e26fc64e24476d5a62fed9b04d1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 452 }, "ua_disagreement": false } }, { "hash": "t13d751100_479067518aa3_173082c9b150", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d751100", "b": "479067518aa3", "c": "173082c9b150", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 75, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-163-159-162-158-52394-49327-49325-49188-49192-49162-49172-49315-49311-107-106-57-56-49326-49324-49187-49191-49161-49171-49314-49310-103-64-51-50-49245-49249-49244-49248-49267-49271-49266-49270-49239-49235-49238-49234-196-195-190-189-136-135-69-68-157-156-49313-49309-49312-49308-61-60-53-47-49233-49232-192-186-132-65-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789277340, "last_seen": 1789277632, "transport": "t", "ja3_hash": "da12c94da8021bbaf502907ad086e7bc", "ja3_variant_count": 1, "ja3_variants": [ "da12c94da8021bbaf502907ad086e7bc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/122.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/122.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/122.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d751100_479067518aa3_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d751100", "b": "479067518aa3", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 75, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-162-163-159-49191-49187-49171-49161-49192-49188-49172-49162-103-51-64-107-56-57-156-157-49326-49324-49314-49310-50-49312-49308-60-47-49327-49325-49315-49311-106-49313-49309-61-53-52393-52392-52394-49245-49249-49239-49235-49244-49248-49238-49234-49267-49271-196-195-49266-49270-190-189-136-135-69-68-49233-49232-192-186-132-65-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 22, "first_seen": 1787495627, "last_seen": 1789954589, "transport": "t", "ja3_hash": "a468eae2a82cd86fea9fd0c541ed8ff0", "ja3_variant_count": 3, "ja3_variants": [ "a468eae2a82cd86fea9fd0c541ed8ff0", "d220a0948b0aa07286b432e28a19f5b5", "5232f1c67a1d474ee004f996d7a1ef9f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.3": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Trailer/93.3.8652.5": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.1958": 1 }, "ua_disagreement": false } }, { "hash": "t13d781200_ab95583b6d39_80a66a7241b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d781200", "b": "ab95583b6d39", "c": "80a66a7241b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 78, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-154-153-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-132-150-65-255,0-11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789812966, "last_seen": 1789812966, "transport": "t", "ja3_hash": "e2365f4bb718d121f8db95865f8b0192", "ja3_variant_count": 1, "ja3_variants": [ "e2365f4bb718d121f8db95865f8b0192" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 15.2; rv:119.0) Gecko/20100101 Firefox/119.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d871000_c66346c74e42_c09c0586aa1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d871000", "b": "c66346c74e42", "c": "c09c0586aa1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 87, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 15, "first_seen": 1787584194, "last_seen": 1789061225, "transport": "t", "ja3_hash": "de72b07c9190406d2e3e50ed41573c79", "ja3_variant_count": 1, "ja3_variants": [ "de72b07c9190406d2e3e50ed41573c79" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 8, "curl/8.14.1": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d9013h2_c6771aded2ed_be6b31666b21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d9013h2", "b": "c6771aded2ed", "c": "be6b31666b21", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 90, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-150-65,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788662534, "last_seen": 1789831661, "transport": "t", "ja3_hash": "1d573f07cf9592c93700cd3f524279e0", "ja3_variant_count": 1, "ja3_variants": [ "1d573f07cf9592c93700cd3f524279e0" ], "user_agents": { "Mozilla/5.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d9013ht_c6771aded2ed_be6b31666b21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d9013ht", "b": "c6771aded2ed", "c": "be6b31666b21", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 90, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-150-65,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 18, "first_seen": 1787764957, "last_seen": 1788774655, "transport": "t", "ja3_hash": "c654189f0cbcfb638bb74b824e790138", "ja3_variant_count": 1, "ja3_variants": [ "c654189f0cbcfb638bb74b824e790138" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36": 15, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13d9112ht_0d5420ba6086_3fc9930d72b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d9112ht", "b": "0d5420ba6086", "c": "3fc9930d72b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 91, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-150-65-255,0-11-10-35-16-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789488672, "last_seen": 1789824131, "transport": "t", "ja3_hash": "fa3a9d56d33ec3d9cfe479b7017482e8", "ja3_variant_count": 1, "ja3_variants": [ "fa3a9d56d33ec3d9cfe479b7017482e8" ], "user_agents": { "Mozilla/5.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d921000_1a0666d6c920_7ef8eb972a3c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d921000", "b": "1a0666d6c920", "c": "7ef8eb972a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 92, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-167-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-166-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-150-65-7-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789122142, "last_seen": 1789122142, "transport": "t", "ja3_hash": "155d76c346dc6d93f3164cde50581e11", "ja3_variant_count": 1, "ja3_variants": [ "155d76c346dc6d93f3164cde50581e11" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d9912ht_ee3966d44962_1c142f2ba1d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d9912ht", "b": "ee3966d44962", "c": "1c142f2ba1d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 99, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-10-49158-49168-49173-59-2-1-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 520, "first_seen": 1787442954, "last_seen": 1789968091, "transport": "t", "ja3_hash": "6fcafe7a659fde3135f818ad9eb434ad", "ja3_variant_count": 1, "ja3_variants": [ "6fcafe7a659fde3135f818ad9eb434ad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)": 3458 }, "ua_disagreement": false } }, { "hash": "t13i030800_55b375c5d22e_97f8aa674fd9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i030800", "b": "55b375c5d22e", "c": "97f8aa674fd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 30, "first_seen": 1787469792, "last_seen": 1789966153, "transport": "t", "ja3_hash": "7f9afda94eb685adc8d863d934bf54bd", "ja3_variant_count": 1, "ja3_variants": [ "7f9afda94eb685adc8d863d934bf54bd" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0": 1, "Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i100900_61a7ad8aa9b6_56c777df044d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i100900", "b": "61a7ad8aa9b6", "c": "56c777df044d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-13-43-10-11-5-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788886862, "last_seen": 1788886862, "transport": "t", "ja3_hash": "96758dba33c0555f410a979860d1c5fd", "ja3_variant_count": 1, "ja3_variants": [ "96758dba33c0555f410a979860d1c5fd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1010ht_61a7ad8aa9b6_0b042736a1c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1010ht", "b": "61a7ad8aa9b6", "c": "0b042736a1c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-35-45-5-51-16-23-10-13-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1787658160, "last_seen": 1788812014, "transport": "t", "ja3_hash": "a4d87e52b3f4eb161f55a36c9036998a", "ja3_variant_count": 1, "ja3_variants": [ "a4d87e52b3f4eb161f55a36c9036998a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1010ht_61a7ad8aa9b6_881d5e41be7c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1010ht", "b": "61a7ad8aa9b6", "c": "881d5e41be7c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-45-23-43-16-51-10-35-13-11,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 397, "first_seen": 1788563259, "last_seen": 1789838681, "transport": "t", "ja3_hash": "f5a8f38f69f926ff7e1a95e6119b4331", "ja3_variant_count": 394, "ja3_variants": [ "f5a8f38f69f926ff7e1a95e6119b4331", "a9a20919d29cc3cf41e405a9811e1027", "11e46df7b75b20156c735240d404f47a", "aa2e52efc02a855081f2bf24ea5809cc", "7f0ca88845597357bcd03f1bf6f190f4", "cef1ce311631ed5e68a5e8aef34869f1", "74631f218c670ac12588f7cf3f63f0cc", "c9b832d1ab6a68e64a0220c2353408f5", "f4d222cbab9f66c78f093e9be0a1dff8", "811e5afa60d1a9197e0914e1575bf13b", "6d2809d1c646501a552cf85386b5f06e", "179942646b115506fcbea9de2e5f1f33" ], "user_agents": { "crusader-worker/1.0": 184, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 53, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 266 }, "ua_disagreement": false } }, { "hash": "t13i1010ht_61a7ad8aa9b6_88f46c37f1f9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1010ht", "b": "61a7ad8aa9b6", "c": "88f46c37f1f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-13-16-45-11-51-43-23-10-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 47, "first_seen": 1788686717, "last_seen": 1788812013, "transport": "t", "ja3_hash": "2afc574147a0024d7c212d5eed2d03da", "ja3_variant_count": 47, "ja3_variants": [ "2afc574147a0024d7c212d5eed2d03da", "3cac294e3337e2bd54466edc823488e0", "4c793345930e05add656f0934e2cf811", "8dc80972b79b12b2daab60e15b56b91c", "85bb06031fa2b81e214b3ae5833c6d0b", "1256d5f7eafb3e6ec170839fe137d3bd", "51787cada0479a8d9ff0403c60117e00", "472d62b3a6ea40b69c11b6bbae2544c6", "fc84eafb9dcab2399e1669164e2777ba", "9345fe5c143a4e66e75097c3039ab8ca", "b9d9f88743ecb4ef0f5b2b43fb18eb74", "9cf989e6a2809c98da34b4fa74b313ec" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 36 }, "ua_disagreement": false } }, { "hash": "t13i130900_f57a46bbacb6_e7c285222651", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i130900", "b": "f57a46bbacb6", "c": "e7c285222651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 131, "first_seen": 1787557835, "last_seen": 1789910074, "transport": "t", "ja3_hash": "6639916abfac56b9257ca216677085bc", "ja3_variant_count": 2, "ja3_variants": [ "6639916abfac56b9257ca216677085bc", "674c9b60629e4885877f5ec76f21723e" ], "user_agents": { "RecordedFuture Global Inventory Crawler": 17, "Go-http-client/1.1": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0": 55, "what-vpn-go/0.1": 2, "Mozilla/5.0": 7, "Mozilla/5.0 (compatible; what-vpn-go/0.1)": 3 }, "ua_disagreement": true } }, { "hash": "t13i131000_f57a46bbacb6_2dd10c1a5aba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i131000", "b": "f57a46bbacb6", "c": "2dd10c1a5aba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-35-65281-23-18-5-10-13-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787851181, "last_seen": 1789208917, "transport": "t", "ja3_hash": "2bb8066f8aef758fe0ebdf26ce012609", "ja3_variant_count": 1, "ja3_variants": [ "2bb8066f8aef758fe0ebdf26ce012609" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.318.108 Safari/537.36; compatible; Claude-User/1.0; +Claude-User@anthropic.com": 1, "Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.3533.1 Mobile Safari/537.36; compatible; Claude-User/1.0; +https://www.anthropic.com/cl": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user) Chrome/85.0.6466.15 Safar": 1 }, "ua_disagreement": false } }, { "hash": "t13i131000_f57a46bbacb6_ab7e3b40a677", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i131000", "b": "f57a46bbacb6", "c": "ab7e3b40a677", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1359, "first_seen": 1787450447, "last_seen": 1789966035, "transport": "t", "ja3_hash": "2196848d251b217de8b2c037e356c11d", "ja3_variant_count": 3, "ja3_variants": [ "2196848d251b217de8b2c037e356c11d", "725543c78edf669194c11dc7a039b56e", "fcf8fb9a64c165eafca9822192c1b969" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 49, "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 148, "Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity": 32, "curl/7.61.1": 21, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0": 4 }, "ua_disagreement": true } }, { "hash": "t13i131000_f57a46bbacb6_e5728521abd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i131000", "b": "f57a46bbacb6", "c": "e5728521abd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 28, "first_seen": 1787609850, "last_seen": 1788766559, "transport": "t", "ja3_hash": "ad8e2ddea9ec0a77edc063c36fc6cecc", "ja3_variant_count": 1, "ja3_variants": [ "ad8e2ddea9ec0a77edc063c36fc6cecc" ], "user_agents": { "Mozilla/5.0 (Android 14; Mobile; rv:123.0) Gecko/123.0 Firefox/123": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i1311ht_f57a46bbacb6_d86ca3cca451", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1311ht", "b": "f57a46bbacb6", "c": "d86ca3cca451", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-16-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 52, "first_seen": 1787889959, "last_seen": 1789904491, "transport": "t", "ja3_hash": "60828da5b42313d165aae2938e651b72", "ja3_variant_count": 1, "ja3_variants": [ "60828da5b42313d165aae2938e651b72" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/128 Safari/537.36": 38, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 73, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13i131200_f57a46bbacb6_7e55ffd90fc1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i131200", "b": "f57a46bbacb6", "c": "7e55ffd90fc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 12, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-35-65281-23-18-5-10-13-43-51-45-41,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 232, "first_seen": 1787851183, "last_seen": 1789208917, "transport": "t", "ja3_hash": "879fcbac0ba29304629c82b09581bd46", "ja3_variant_count": 1, "ja3_variants": [ "879fcbac0ba29304629c82b09581bd46" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Discordbot/2.0; +https://discordapp.com) Chrome/134.0.2218.58 Safari/537.36 Edg/134.0.2": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GrokBot/1.0; +https://x.ai/grokbot)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Applebot/0.1; +http://www.apple.com/go/applebot) Chrome/126.0.7356.112 Safari/537": 1 }, "ua_disagreement": false } }, { "hash": "t13i141000_cbb2034c60b8_e5728521abd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i141000", "b": "cbb2034c60b8", "c": "e5728521abd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 14, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 101, "first_seen": 1787622542, "last_seen": 1789958544, "transport": "t", "ja3_hash": "2079bcc000c9a54e0784733c0142d140", "ja3_variant_count": 1, "ja3_variants": [ "2079bcc000c9a54e0784733c0142d140" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0": 9, "Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i1410ht_cbb2034c60b8_da06f2e414f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (da06f2e414f4) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13i1410ht", "b": "cbb2034c60b8", "c": "da06f2e414f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 14, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-16-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789517112, "last_seen": 1789517112, "transport": "t", "ja3_hash": "b625eeea88c81fdb728f44fd7c10e710", "ja3_variant_count": 1, "ja3_variants": [ "b625eeea88c81fdb728f44fd7c10e710" ], "user_agents": { "Mozilla/5.0 (compatible; ncentral-scan/1.0)": 1 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13i150200_8daaf6152771_e73cb7da2dfc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150200", "b": "8daaf6152771", "c": "e73cb7da2dfc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787842972, "last_seen": 1789501780, "transport": "t", "ja3_hash": "e51aedfd800e8a9d7b36f565cf3f1508", "ja3_variant_count": 1, "ja3_variants": [ "e51aedfd800e8a9d7b36f565cf3f1508" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_04b14dc380a8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "04b14dc380a8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789539392, "last_seen": 1789686681, "transport": "t", "ja3_hash": "b4840cb7a136ee5bcfffaab3b70c216f", "ja3_variant_count": 1, "ja3_variants": [ "b4840cb7a136ee5bcfffaab3b70c216f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_215f3d469cd5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "215f3d469cd5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789319848, "last_seen": 1789730696, "transport": "t", "ja3_hash": "78a605d37b3a6c4468fc4393269337d1", "ja3_variant_count": 1, "ja3_variants": [ "78a605d37b3a6c4468fc4393269337d1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_41b57b44cf22", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "41b57b44cf22", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1787936457, "last_seen": 1789484257, "transport": "t", "ja3_hash": "8e9ec91cb83586a5924f4b7e93fa7139", "ja3_variant_count": 1, "ja3_variants": [ "8e9ec91cb83586a5924f4b7e93fa7139" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_6c58999868bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "6c58999868bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788724241, "last_seen": 1788724241, "transport": "t", "ja3_hash": "824aa2a6c3455ba73f64f71e1b36d25a", "ja3_variant_count": 1, "ja3_variants": [ "824aa2a6c3455ba73f64f71e1b36d25a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_85c5c6a023d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "85c5c6a023d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789624333, "last_seen": 1789684594, "transport": "t", "ja3_hash": "fe22e981f3bc0aed90705aafcf743769", "ja3_variant_count": 1, "ja3_variants": [ "fe22e981f3bc0aed90705aafcf743769" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_9f72e9d66abc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "9f72e9d66abc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788496183, "last_seen": 1788843231, "transport": "t", "ja3_hash": "ad5ad280f44fbfa544b128378341d1d0", "ja3_variant_count": 2, "ja3_variants": [ "ad5ad280f44fbfa544b128378341d1d0", "34b701bdee40d5a6bb51d4cc94c75e99" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i1503h2_8daaf6152771_266c5487f233", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1503h2", "b": "8daaf6152771", "c": "266c5487f233", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1788512724, "last_seen": 1789929661, "transport": "t", "ja3_hash": "dbcbec3eb296b4e97d1628a1f065c9a4", "ja3_variant_count": 2, "ja3_variants": [ "dbcbec3eb296b4e97d1628a1f065c9a4", "c72e9b03f9ffb919d6532a12906bbe00" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 OPR/119.0.0.0": 1, "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_0e6d02268820", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "0e6d02268820", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789710069, "last_seen": 1789710069, "transport": "t", "ja3_hash": "0c65d9c8140d363a11582c2a0ac8aff4", "ja3_variant_count": 1, "ja3_variants": [ "0c65d9c8140d363a11582c2a0ac8aff4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_101ba9e36379", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "101ba9e36379", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789692125, "last_seen": 1789692125, "transport": "t", "ja3_hash": "4b400ff341fb29439c3b9080eca14d13", "ja3_variant_count": 1, "ja3_variants": [ "4b400ff341fb29439c3b9080eca14d13" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_22adf9fcbd9a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "22adf9fcbd9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-43-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788805883, "last_seen": 1788870583, "transport": "t", "ja3_hash": "fd6f00a4d27fb51775756021a8718d25", "ja3_variant_count": 2, "ja3_variants": [ "fd6f00a4d27fb51775756021a8718d25", "2184ec4ef6c6a153dab4c961ce949bd7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_5b9486e65a57", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "5b9486e65a57", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788790414, "last_seen": 1788790414, "transport": "t", "ja3_hash": "e73cf5f40cdc67593d7b0aab6256ec10", "ja3_variant_count": 1, "ja3_variants": [ "e73cf5f40cdc67593d7b0aab6256ec10" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_7d06e6a78045", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "7d06e6a78045", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789695937, "last_seen": 1789695937, "transport": "t", "ja3_hash": "f5cee628290c65ebc80e383dbb0398b7", "ja3_variant_count": 1, "ja3_variants": [ "f5cee628290c65ebc80e383dbb0398b7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_947d3da51217", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "947d3da51217", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788984125, "last_seen": 1788984125, "transport": "t", "ja3_hash": "b2f0cbd41b9e6774fa1a1bc282d97495", "ja3_variant_count": 1, "ja3_variants": [ "b2f0cbd41b9e6774fa1a1bc282d97495" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_a79eb5675868", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "a79eb5675868", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789692448, "last_seen": 1789692448, "transport": "t", "ja3_hash": "a6b584bb81ca49594240d61dde7fa253", "ja3_variant_count": 1, "ja3_variants": [ "a6b584bb81ca49594240d61dde7fa253" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_c810dfe9e8c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "c810dfe9e8c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789928895, "last_seen": 1789928895, "transport": "t", "ja3_hash": "923a852f1f7cf408dc6fb5b3978590ec", "ja3_variant_count": 1, "ja3_variants": [ "923a852f1f7cf408dc6fb5b3978590ec" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_d2ff498b7713", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "d2ff498b7713", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789438968, "last_seen": 1789438968, "transport": "t", "ja3_hash": "ef0657b4a036e50e0a5fa8f99a99eb4b", "ja3_variant_count": 1, "ja3_variants": [ "ef0657b4a036e50e0a5fa8f99a99eb4b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_fa7314977c09", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "fa7314977c09", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-51-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789229361, "last_seen": 1789229361, "transport": "t", "ja3_hash": "80fd7c95fcfe8e402faa8b7cb8962514", "ja3_variant_count": 1, "ja3_variants": [ "80fd7c95fcfe8e402faa8b7cb8962514" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 9 }, "ua_disagreement": false } }, { "hash": "t13i1504h2_8daaf6152771_3df7d66bf4e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (3df7d66bf4e1) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13i1504h2", "b": "8daaf6152771", "c": "3df7d66bf4e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789366474, "last_seen": 1789366474, "transport": "t", "ja3_hash": "0d60a763717a07dfdafe0ea0bc1bf6ff", "ja3_variant_count": 1, "ja3_variants": [ "0d60a763717a07dfdafe0ea0bc1bf6ff" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13i1504h2_8daaf6152771_fb163ed6e928", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1504h2", "b": "8daaf6152771", "c": "fb163ed6e928", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788459236, "last_seen": 1788459236, "transport": "t", "ja3_hash": "5e59fccda389ca437cfdb0ba8a897f20", "ja3_variant_count": 1, "ja3_variants": [ "5e59fccda389ca437cfdb0ba8a897f20" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_0650121f63a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "0650121f63a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-51-43-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789040429, "last_seen": 1789040429, "transport": "t", "ja3_hash": "7d45b39fd2eeb78a3ec024ce58a9531d", "ja3_variant_count": 1, "ja3_variants": [ "7d45b39fd2eeb78a3ec024ce58a9531d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_1ac4601af77f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "1ac4601af77f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-65281-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789473585, "last_seen": 1789473585, "transport": "t", "ja3_hash": "2574cd90fdf31a173a2a2038a1cfc317", "ja3_variant_count": 1, "ja3_variants": [ "2574cd90fdf31a173a2a2038a1cfc317" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_4c93e6dcfdd7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "4c93e6dcfdd7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-43-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788844066, "last_seen": 1788844066, "transport": "t", "ja3_hash": "11d9040c772469b41205557ada38edca", "ja3_variant_count": 1, "ja3_variants": [ "11d9040c772469b41205557ada38edca" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_6a70ee977655", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "6a70ee977655", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-43-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788782645, "last_seen": 1788782645, "transport": "t", "ja3_hash": "4ba7f28d2e6a2f4c4b06527ca9104d73", "ja3_variant_count": 1, "ja3_variants": [ "4ba7f28d2e6a2f4c4b06527ca9104d73" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_73ef849fbad4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "73ef849fbad4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-51764-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789747795, "last_seen": 1789747795, "transport": "t", "ja3_hash": "42591962c830534399cc2ec82178f108", "ja3_variant_count": 1, "ja3_variants": [ "42591962c830534399cc2ec82178f108" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_8891d76966e6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "8891d76966e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-35-43-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789538326, "last_seen": 1789538326, "transport": "t", "ja3_hash": "14f01e7828874750aa26022eca335702", "ja3_variant_count": 1, "ja3_variants": [ "14f01e7828874750aa26022eca335702" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 59 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_8fa7a5ed17e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "8fa7a5ed17e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-27-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789146215, "last_seen": 1789146215, "transport": "t", "ja3_hash": "0afa4dfd98c78cd4d8910a6af79e9cbc", "ja3_variant_count": 1, "ja3_variants": [ "0afa4dfd98c78cd4d8910a6af79e9cbc" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 15_7 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Criw/120.0.0.0 Mobile/15E148 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_91f9f683c041", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "91f9f683c041", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-10-51-51764,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788931110, "last_seen": 1788931110, "transport": "t", "ja3_hash": "5edb0eeb0b8ea0d9c074446528995db2", "ja3_variant_count": 1, "ja3_variants": [ "5edb0eeb0b8ea0d9c074446528995db2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 45 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_9c553a857f86", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "9c553a857f86", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-5-35-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839948, "last_seen": 1788839948, "transport": "t", "ja3_hash": "9d92efafed0b31c0273cdeba27c05f18", "ja3_variant_count": 1, "ja3_variants": [ "9d92efafed0b31c0273cdeba27c05f18" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_b249e5273553", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "b249e5273553", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-13-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789022826, "last_seen": 1789022826, "transport": "t", "ja3_hash": "1db509858fd525ca6f8fe927e72a2594", "ja3_variant_count": 1, "ja3_variants": [ "1db509858fd525ca6f8fe927e72a2594" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_b41f38bac23b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "b41f38bac23b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-5-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788708551, "last_seen": 1788708551, "transport": "t", "ja3_hash": "2443788e2edb08587aa9429462004484", "ja3_variant_count": 1, "ja3_variants": [ "2443788e2edb08587aa9429462004484" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_dde9317eac23", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "dde9317eac23", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788980906, "last_seen": 1788980906, "transport": "t", "ja3_hash": "f569cefcf48d69c7932b1f6595817bc5", "ja3_variant_count": 1, "ja3_variants": [ "f569cefcf48d69c7932b1f6595817bc5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_fe946d04140a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "fe946d04140a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-45-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788861606, "last_seen": 1788861606, "transport": "t", "ja3_hash": "c5f54dfa76384695ca7219f4db7b30a0", "ja3_variant_count": 1, "ja3_variants": [ "c5f54dfa76384695ca7219f4db7b30a0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_3fbc8b58284f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "3fbc8b58284f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788727200, "last_seen": 1788727200, "transport": "t", "ja3_hash": "4cf21f9125b010e2ad81ba46d9876220", "ja3_variant_count": 1, "ja3_variants": [ "4cf21f9125b010e2ad81ba46d9876220" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_40d5251d8300", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "40d5251d8300", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-16-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789694210, "last_seen": 1789694210, "transport": "t", "ja3_hash": "0e2b7a9f57005a2e490b39e1396dcfd8", "ja3_variant_count": 1, "ja3_variants": [ "0e2b7a9f57005a2e490b39e1396dcfd8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_8492fe99efbf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (8492fe99efbf) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "8492fe99efbf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-16-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788812134, "last_seen": 1788812134, "transport": "t", "ja3_hash": "a1a83b428e4331509319f1461953f2e7", "ja3_variant_count": 1, "ja3_variants": [ "a1a83b428e4331509319f1461953f2e7" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13i1505h2_8daaf6152771_9f1804aca672", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "9f1804aca672", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-18-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789092681, "last_seen": 1789092681, "transport": "t", "ja3_hash": "47040b8396e5d0844ee8edd75b90a0ae", "ja3_variant_count": 1, "ja3_variants": [ "47040b8396e5d0844ee8edd75b90a0ae" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505ht_8daaf6152771_8492fe99efbf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505ht", "b": "8daaf6152771", "c": "8492fe99efbf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-65037-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788842606, "last_seen": 1788842606, "transport": "t", "ja3_hash": "584356f414bda839877c58ab9f2f67d5", "ja3_variant_count": 1, "ja3_variants": [ "584356f414bda839877c58ab9f2f67d5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505ht_8daaf6152771_d65de64846ed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505ht", "b": "8daaf6152771", "c": "d65de64846ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-23-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788848235, "last_seen": 1788848235, "transport": "t", "ja3_hash": "c1b3b7df93ece6ae50e8ce92f6d67c61", "ja3_variant_count": 1, "ja3_variants": [ "c1b3b7df93ece6ae50e8ce92f6d67c61" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_07d96117b32f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "07d96117b32f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-45-5-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789151473, "last_seen": 1789151473, "transport": "t", "ja3_hash": "bba8a0700508838b1f2a50d1bb0b3e3e", "ja3_variant_count": 1, "ja3_variants": [ "bba8a0700508838b1f2a50d1bb0b3e3e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_0b502eaac743", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "0b502eaac743", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-27-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789766892, "last_seen": 1789766892, "transport": "t", "ja3_hash": "d857e9fc2e20c3ee0fcd6902dc201647", "ja3_variant_count": 1, "ja3_variants": [ "d857e9fc2e20c3ee0fcd6902dc201647" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 19 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_1ca0c75991c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "1ca0c75991c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-65037-18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789201598, "last_seen": 1789201598, "transport": "t", "ja3_hash": "f4a249c0923007e07a0592687fb981b2", "ja3_variant_count": 1, "ja3_variants": [ "f4a249c0923007e07a0592687fb981b2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_27842348f9b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "27842348f9b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-35-13-43-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669075, "last_seen": 1789669075, "transport": "t", "ja3_hash": "6564c42c57adb840600022c673cc6f29", "ja3_variant_count": 1, "ja3_variants": [ "6564c42c57adb840600022c673cc6f29" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_2c530c0f7d68", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "2c530c0f7d68", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-45-65037-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789626397, "last_seen": 1789626397, "transport": "t", "ja3_hash": "b811326fb9caa3c6c6b2124a92072d2f", "ja3_variant_count": 1, "ja3_variants": [ "b811326fb9caa3c6c6b2124a92072d2f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 64 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_3203b57f2c1d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "3203b57f2c1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-65281-23-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789592009, "last_seen": 1789592009, "transport": "t", "ja3_hash": "355867d29d254521b2a77ab361a63e3c", "ja3_variant_count": 1, "ja3_variants": [ "355867d29d254521b2a77ab361a63e3c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_78c105cf673b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "78c105cf673b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-11-51-13-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789923992, "last_seen": 1789923992, "transport": "t", "ja3_hash": "5903deb2c780df674fc26542ec2383d0", "ja3_variant_count": 1, "ja3_variants": [ "5903deb2c780df674fc26542ec2383d0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_7e58f2fee93b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "7e58f2fee93b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-45-43-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788827825, "last_seen": 1788827825, "transport": "t", "ja3_hash": "69f6b633b7c96a83adfccfe89ac2d5a0", "ja3_variant_count": 1, "ja3_variants": [ "69f6b633b7c96a83adfccfe89ac2d5a0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_8a92ca05af84", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "8a92ca05af84", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-5-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789146151, "last_seen": 1789146151, "transport": "t", "ja3_hash": "80b9a4c86db990c44a760b1297180728", "ja3_variant_count": 1, "ja3_variants": [ "80b9a4c86db990c44a760b1297180728" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_8c2492ec3524", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "8c2492ec3524", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-65037-43-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788761907, "last_seen": 1789565236, "transport": "t", "ja3_hash": "6a5395a7700e8660628e2504b9bb539d", "ja3_variant_count": 2, "ja3_variants": [ "6a5395a7700e8660628e2504b9bb539d", "48528a192aef948988fd3c5c643a5d8e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_8d7285a10dac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "8d7285a10dac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-65281-11-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789401795, "last_seen": 1789401795, "transport": "t", "ja3_hash": "19c452e24e8762ae5d8fb9d76bdcb364", "ja3_variant_count": 1, "ja3_variants": [ "19c452e24e8762ae5d8fb9d76bdcb364" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 26 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_a27ec7c2bb60", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "a27ec7c2bb60", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-43-45-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789879912, "last_seen": 1789879912, "transport": "t", "ja3_hash": "4c4498149b878037e096855210d52c13", "ja3_variant_count": 1, "ja3_variants": [ "4c4498149b878037e096855210d52c13" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_a3ae913e739f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "a3ae913e739f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-65037-43-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788867629, "last_seen": 1788867629, "transport": "t", "ja3_hash": "f8ea049f5988980c6e755bd1ff5c75d8", "ja3_variant_count": 1, "ja3_variants": [ "f8ea049f5988980c6e755bd1ff5c75d8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_ab6991f436d7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "ab6991f436d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-35-51-17613-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789656592, "last_seen": 1789656592, "transport": "t", "ja3_hash": "5fd7f3d044ff38001550a440a5d65fe4", "ja3_variant_count": 1, "ja3_variants": [ "5fd7f3d044ff38001550a440a5d65fe4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_af800d75af69", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "af800d75af69", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-43-65037-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788792345, "last_seen": 1788792345, "transport": "t", "ja3_hash": "91bbf9c65fcdc1905752b868ed6d9629", "ja3_variant_count": 1, "ja3_variants": [ "91bbf9c65fcdc1905752b868ed6d9629" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_c0e903e951bd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "c0e903e951bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-43-10-51-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789140046, "last_seen": 1789140046, "transport": "t", "ja3_hash": "51253adcb505c2a23bbd9797d5b7c57a", "ja3_variant_count": 1, "ja3_variants": [ "51253adcb505c2a23bbd9797d5b7c57a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_d4bcbfba44ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "d4bcbfba44ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51-5-27-11-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788858844, "last_seen": 1788858844, "transport": "t", "ja3_hash": "6e608dab500da178dff5ec2bfaa1a223", "ja3_variant_count": 1, "ja3_variants": [ "6e608dab500da178dff5ec2bfaa1a223" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_e8dc25b04468", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "e8dc25b04468", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-11-65281-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789625573, "last_seen": 1789625573, "transport": "t", "ja3_hash": "0120c6420fcea060884c6f7ac286d9f6", "ja3_variant_count": 1, "ja3_variants": [ "0120c6420fcea060884c6f7ac286d9f6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_febd682b6ce7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "febd682b6ce7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-10-65281-43-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788582218, "last_seen": 1788582218, "transport": "t", "ja3_hash": "9f82ca3d75a469683d809612191acabc", "ja3_variant_count": 1, "ja3_variants": [ "9f82ca3d75a469683d809612191acabc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_0cc47d9663ae", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "0cc47d9663ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-10-65281-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788785803, "last_seen": 1788785803, "transport": "t", "ja3_hash": "29c06e0c7a9e535f1f2eac6ebfb625d4", "ja3_variant_count": 1, "ja3_variants": [ "29c06e0c7a9e535f1f2eac6ebfb625d4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_150eb2813d6d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "150eb2813d6d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-35-45-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789698153, "last_seen": 1789698153, "transport": "t", "ja3_hash": "2590387dfd2dec3035dd96af1ad7fac4", "ja3_variant_count": 1, "ja3_variants": [ "2590387dfd2dec3035dd96af1ad7fac4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_58bd7423d0cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "58bd7423d0cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-43-45-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788775518, "last_seen": 1788775518, "transport": "t", "ja3_hash": "7a70876d5193e2a49674fddcd21cdd91", "ja3_variant_count": 1, "ja3_variants": [ "7a70876d5193e2a49674fddcd21cdd91" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_6896342285d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "6896342285d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-65281-16-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788771313, "last_seen": 1788771313, "transport": "t", "ja3_hash": "305303c58ea1acab1b6712afc421b3e1", "ja3_variant_count": 1, "ja3_variants": [ "305303c58ea1acab1b6712afc421b3e1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_b43d6105d122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "b43d6105d122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-17613-45-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788791330, "last_seen": 1788791330, "transport": "t", "ja3_hash": "b729a47ebcbb4ee7b6aa2db6c3be41f5", "ja3_variant_count": 1, "ja3_variants": [ "b729a47ebcbb4ee7b6aa2db6c3be41f5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_ea968fbdba49", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "ea968fbdba49", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-65281-35-43-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788535353, "last_seen": 1788535353, "transport": "t", "ja3_hash": "38ad2dae2f2c97d6b0ef94b4d71b85c3", "ja3_variant_count": 1, "ja3_variants": [ "38ad2dae2f2c97d6b0ef94b4d71b85c3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13i1506ht_8daaf6152771_69297ef1d631", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506ht", "b": "8daaf6152771", "c": "69297ef1d631", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-5-16-43-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788856019, "last_seen": 1788856019, "transport": "t", "ja3_hash": "344c4f46ec0adb94b9ba99725b6f8804", "ja3_variant_count": 1, "ja3_variants": [ "344c4f46ec0adb94b9ba99725b6f8804" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506ht_8daaf6152771_86a8e8592cf0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506ht", "b": "8daaf6152771", "c": "86a8e8592cf0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-43-45-10-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789631602, "last_seen": 1789631602, "transport": "t", "ja3_hash": "8db7af429df82e75ac83ce576239c20c", "ja3_variant_count": 1, "ja3_variants": [ "8db7af429df82e75ac83ce576239c20c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506ht_8daaf6152771_e95637dbffd2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506ht", "b": "8daaf6152771", "c": "e95637dbffd2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-10-16-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788836867, "last_seen": 1788836867, "transport": "t", "ja3_hash": "c6acaf9fb4ff8373e3ddb0ecf0f3d30b", "ja3_variant_count": 1, "ja3_variants": [ "c6acaf9fb4ff8373e3ddb0ecf0f3d30b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_14999f56e34e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "14999f56e34e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-65037-43-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789049542, "last_seen": 1789049542, "transport": "t", "ja3_hash": "90782ce33beb28ddbb259c85c7ece3c5", "ja3_variant_count": 1, "ja3_variants": [ "90782ce33beb28ddbb259c85c7ece3c5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_2812d2562093", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "2812d2562093", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-18-65281-45-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789631402, "last_seen": 1789631402, "transport": "t", "ja3_hash": "0b77f6bffe96dc7e35c7622e37e62160", "ja3_variant_count": 1, "ja3_variants": [ "0b77f6bffe96dc7e35c7622e37e62160" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_3a1aba1cf808", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "3a1aba1cf808", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-10-11-43-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788767345, "last_seen": 1788767345, "transport": "t", "ja3_hash": "4c310a0146304cd55e8f38299257fcc6", "ja3_variant_count": 1, "ja3_variants": [ "4c310a0146304cd55e8f38299257fcc6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_4d7a63c27637", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "4d7a63c27637", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-45-43-27-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789938459, "last_seen": 1789938459, "transport": "t", "ja3_hash": "2992be65801bde4320797d5c1a242d90", "ja3_variant_count": 1, "ja3_variants": [ "2992be65801bde4320797d5c1a242d90" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_50200da7cc2f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "50200da7cc2f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-45-27-23-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789711536, "last_seen": 1789711536, "transport": "t", "ja3_hash": "4a4f7df7f835200fa74326f3a3a9c7a8", "ja3_variant_count": 1, "ja3_variants": [ "4a4f7df7f835200fa74326f3a3a9c7a8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_547f055cdb4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "547f055cdb4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-35-65281-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789418930, "last_seen": 1789418930, "transport": "t", "ja3_hash": "042af20b858b5de081740ab84689e526", "ja3_variant_count": 1, "ja3_variants": [ "042af20b858b5de081740ab84689e526" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_57cc270822f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "57cc270822f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-35-18-43-51-16,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789109337, "last_seen": 1789109337, "transport": "t", "ja3_hash": "a1e13b5b936ab61a478329d055736d8e", "ja3_variant_count": 1, "ja3_variants": [ "a1e13b5b936ab61a478329d055736d8e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_627e3b60aa8a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "627e3b60aa8a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-65281-27-65037-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788776877, "last_seen": 1788776877, "transport": "t", "ja3_hash": "2ab5ed661b9141cbd1851a4d77ff6da0", "ja3_variant_count": 1, "ja3_variants": [ "2ab5ed661b9141cbd1851a4d77ff6da0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_7c3e28ec6004", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "7c3e28ec6004", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-27-13-65037-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788788485, "last_seen": 1788788485, "transport": "t", "ja3_hash": "12df6789272ff35f384c719faba92542", "ja3_variant_count": 1, "ja3_variants": [ "12df6789272ff35f384c719faba92542" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_7d49d8d4b0e9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "7d49d8d4b0e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,51764-18-27-17613-45-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789841715, "last_seen": 1789841715, "transport": "t", "ja3_hash": "2fec933d50ec470c6ee6ff37d5f8ec42", "ja3_variant_count": 1, "ja3_variants": [ "2fec933d50ec470c6ee6ff37d5f8ec42" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_9c5fe9d0f94a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "9c5fe9d0f94a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-23-51-11-10-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788843496, "last_seen": 1788843496, "transport": "t", "ja3_hash": "57fde5a81159f835b12e1fbed7f2cf44", "ja3_variant_count": 1, "ja3_variants": [ "57fde5a81159f835b12e1fbed7f2cf44" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_ad454b251b66", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "ad454b251b66", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-65281-17613-43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788801247, "last_seen": 1788801247, "transport": "t", "ja3_hash": "106ce899f50265b37744ba913ee4b51e", "ja3_variant_count": 1, "ja3_variants": [ "106ce899f50265b37744ba913ee4b51e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_b5c41e43d591", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "b5c41e43d591", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-23-11-35-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789747799, "last_seen": 1789747799, "transport": "t", "ja3_hash": "5621ca4c4541b537047fd06037d04765", "ja3_variant_count": 1, "ja3_variants": [ "5621ca4c4541b537047fd06037d04765" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/149.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_b7d0bc79fdc5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "b7d0bc79fdc5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-43-10-65281-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788715623, "last_seen": 1788715623, "transport": "t", "ja3_hash": "891b4956079d656c097e2e18b759ccd7", "ja3_variant_count": 1, "ja3_variants": [ "891b4956079d656c097e2e18b759ccd7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_c0d1c8f9847b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "c0d1c8f9847b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-18-13-43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788852810, "last_seen": 1788852810, "transport": "t", "ja3_hash": "a3967fce74f468fbbbe78389e475bc39", "ja3_variant_count": 1, "ja3_variants": [ "a3967fce74f468fbbbe78389e475bc39" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_ca98a246c5c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "ca98a246c5c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-23-11-35-45-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789626866, "last_seen": 1789626866, "transport": "t", "ja3_hash": "29647e496e797340ad0f588ea765c48c", "ja3_variant_count": 1, "ja3_variants": [ "29647e496e797340ad0f588ea765c48c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_cca87d30bc92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "cca87d30bc92", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-17613-18-43-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788714054, "last_seen": 1788714054, "transport": "t", "ja3_hash": "cc04c6a50c5948277377d7bd147f97d7", "ja3_variant_count": 1, "ja3_variants": [ "cc04c6a50c5948277377d7bd147f97d7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_d42f186072f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "d42f186072f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-23-18-11-43-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789750662, "last_seen": 1789750662, "transport": "t", "ja3_hash": "78a7dc871454e29a1c64e22e77833558", "ja3_variant_count": 1, "ja3_variants": [ "78a7dc871454e29a1c64e22e77833558" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_dea85b3dae42", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "dea85b3dae42", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-18-17613-5-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788819027, "last_seen": 1788824704, "transport": "t", "ja3_hash": "fec032dd6ad2e23c5d5811be8a582c87", "ja3_variant_count": 2, "ja3_variants": [ "fec032dd6ad2e23c5d5811be8a582c87", "06635f85af8fc1cf9b99e20a771a2003" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_df0708bddc57", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "df0708bddc57", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-27-43-45-13-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788830046, "last_seen": 1788830046, "transport": "t", "ja3_hash": "3f61276fafe0f4d601d35f45a650dddd", "ja3_variant_count": 1, "ja3_variants": [ "3f61276fafe0f4d601d35f45a650dddd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_e0243d11bc2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "e0243d11bc2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-43-18-10-11-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789627310, "last_seen": 1789627310, "transport": "t", "ja3_hash": "c22550ffcf043750313e3e4d66a0c346", "ja3_variant_count": 1, "ja3_variants": [ "c22550ffcf043750313e3e4d66a0c346" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_e04448979512", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "e04448979512", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-65281-18-51-13-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669083, "last_seen": 1789669083, "transport": "t", "ja3_hash": "6fc5a91988713b098b08aaabc362de04", "ja3_variant_count": 1, "ja3_variants": [ "6fc5a91988713b098b08aaabc362de04" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_e2dd93164c3f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "e2dd93164c3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-43-13-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788570129, "last_seen": 1788570129, "transport": "t", "ja3_hash": "1adf406338f8e6b68e10257c5cd9cb80", "ja3_variant_count": 1, "ja3_variants": [ "1adf406338f8e6b68e10257c5cd9cb80" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_ec406718d266", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "ec406718d266", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-43-51-35-13-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789838663, "last_seen": 1789838663, "transport": "t", "ja3_hash": "c5344231fb43ef334ac38442e0094b1f", "ja3_variant_count": 1, "ja3_variants": [ "c5344231fb43ef334ac38442e0094b1f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_f953e29ac03a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "f953e29ac03a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-23-11-45-43-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789688473, "last_seen": 1789688473, "transport": "t", "ja3_hash": "aae802acf7334ca10af2fa4da6501649", "ja3_variant_count": 1, "ja3_variants": [ "aae802acf7334ca10af2fa4da6501649" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_fbad43ae38b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "fbad43ae38b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51764-11-5-45-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789683771, "last_seen": 1789683771, "transport": "t", "ja3_hash": "1a9d79e69ebb3d416165bf3f784f1758", "ja3_variant_count": 1, "ja3_variants": [ "1a9d79e69ebb3d416165bf3f784f1758" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_037e30ce60d7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "037e30ce60d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-13-17613-43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789058359, "last_seen": 1789058359, "transport": "t", "ja3_hash": "e36f5ae7cc4289d7afe950fc40ddbb16", "ja3_variant_count": 1, "ja3_variants": [ "e36f5ae7cc4289d7afe950fc40ddbb16" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_3aaab0ba5b05", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "3aaab0ba5b05", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-18-11-65281-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789033940, "last_seen": 1789033940, "transport": "t", "ja3_hash": "3c90017593a30e9b9602d58d52e0737c", "ja3_variant_count": 1, "ja3_variants": [ "3c90017593a30e9b9602d58d52e0737c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_4954ab98b428", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "4954ab98b428", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-16-43-51-10-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789501602, "last_seen": 1789501602, "transport": "t", "ja3_hash": "6f4d539db85535b1a48f51b7dd921cb9", "ja3_variant_count": 1, "ja3_variants": [ "6f4d539db85535b1a48f51b7dd921cb9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_5d6252693bbf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "5d6252693bbf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-43-5-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789796468, "last_seen": 1789796468, "transport": "t", "ja3_hash": "3c503a8cb593dd22c7ff1a9a96901378", "ja3_variant_count": 1, "ja3_variants": [ "3c503a8cb593dd22c7ff1a9a96901378" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_631c97e87732", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "631c97e87732", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-65281-43-16-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788784455, "last_seen": 1788784455, "transport": "t", "ja3_hash": "0b3fa4bee11542c14defad851dfa8c68", "ja3_variant_count": 1, "ja3_variants": [ "0b3fa4bee11542c14defad851dfa8c68" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_637da8953776", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "637da8953776", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-23-65037-18-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789685664, "last_seen": 1789685664, "transport": "t", "ja3_hash": "e9224578d7d7cd396cd7f221174409cc", "ja3_variant_count": 1, "ja3_variants": [ "e9224578d7d7cd396cd7f221174409cc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_7e3905d93d65", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "7e3905d93d65", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-45-27-16-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789680774, "last_seen": 1789680774, "transport": "t", "ja3_hash": "361bec099f2a7defbe87286a2c721031", "ja3_variant_count": 1, "ja3_variants": [ "361bec099f2a7defbe87286a2c721031" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_8349cb20f5d9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "8349cb20f5d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-10-43-65281-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788760622, "last_seen": 1788760622, "transport": "t", "ja3_hash": "e5fff30529417f4c315e05a3e3fff816", "ja3_variant_count": 1, "ja3_variants": [ "e5fff30529417f4c315e05a3e3fff816" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_87dde60cb784", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "87dde60cb784", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-18-45-43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788731312, "last_seen": 1788731312, "transport": "t", "ja3_hash": "b8efaab2625b9022fc61829efa0a9417", "ja3_variant_count": 1, "ja3_variants": [ "b8efaab2625b9022fc61829efa0a9417" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_ac14bacc7fef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "ac14bacc7fef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-65281-65037-16-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789033864, "last_seen": 1789033864, "transport": "t", "ja3_hash": "ff313738030eb61d0ddfecc122662a60", "ja3_variant_count": 1, "ja3_variants": [ "ff313738030eb61d0ddfecc122662a60" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_db227dce0b70", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "db227dce0b70", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-35-43-23-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788711051, "last_seen": 1788711051, "transport": "t", "ja3_hash": "eec8c5228bc7e7e61d378921f6df7339", "ja3_variant_count": 1, "ja3_variants": [ "eec8c5228bc7e7e61d378921f6df7339" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_e85a43562631", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "e85a43562631", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-16-43-11-18-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788931287, "last_seen": 1788931287, "transport": "t", "ja3_hash": "b5a6a17a660911f8c28de2ec2854c9b6", "ja3_variant_count": 1, "ja3_variants": [ "b5a6a17a660911f8c28de2ec2854c9b6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_e8fbccb2f52a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "e8fbccb2f52a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-65281-35-23-43-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788721870, "last_seen": 1788721870, "transport": "t", "ja3_hash": "3f92a5784af559baa5437603b1008c87", "ja3_variant_count": 1, "ja3_variants": [ "3f92a5784af559baa5437603b1008c87" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_f7f40c1fd32f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "f7f40c1fd32f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-43-10-16-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789444999, "last_seen": 1789444999, "transport": "t", "ja3_hash": "3ff8d7a8e758fee131033d00b334df3f", "ja3_variant_count": 1, "ja3_variants": [ "3ff8d7a8e758fee131033d00b334df3f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_0157773c0b88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "0157773c0b88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-17613-65037-5-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789061279, "last_seen": 1789061279, "transport": "t", "ja3_hash": "51615fef6019aa21d621e56623808d00", "ja3_variant_count": 1, "ja3_variants": [ "51615fef6019aa21d621e56623808d00" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_0319242fcb3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "0319242fcb3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-35-43-11-23-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788768420, "last_seen": 1788768420, "transport": "t", "ja3_hash": "3fa804ce736066f51661fc7716626ba1", "ja3_variant_count": 1, "ja3_variants": [ "3fa804ce736066f51661fc7716626ba1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_04441fba79bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "04441fba79bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-17613-51-18-11-43-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787964829, "last_seen": 1789710340, "transport": "t", "ja3_hash": "fe339b81fc4398430d4cc0a0b6da8022", "ja3_variant_count": 1, "ja3_variants": [ "fe339b81fc4398430d4cc0a0b6da8022" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.2415.180 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3333.52 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3861.109 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_26e5c5e50624", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "26e5c5e50624", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-13-23-43-51-35-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789677574, "last_seen": 1789677574, "transport": "t", "ja3_hash": "52828423351d44ae552dc79147d8952b", "ja3_variant_count": 1, "ja3_variants": [ "52828423351d44ae552dc79147d8952b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 14 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_27b25b779a0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "27b25b779a0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-10-43-65281-35-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789849776, "last_seen": 1789849776, "transport": "t", "ja3_hash": "c913be15fe494319f28f943c1aa6e92f", "ja3_variant_count": 1, "ja3_variants": [ "c913be15fe494319f28f943c1aa6e92f" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_3692c4e0d45f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "3692c4e0d45f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-23-10-45-18-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789626382, "last_seen": 1789626382, "transport": "t", "ja3_hash": "b0a13f51f1ea5bf27455a19cfb0ec0f1", "ja3_variant_count": 1, "ja3_variants": [ "b0a13f51f1ea5bf27455a19cfb0ec0f1" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 10 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_470fd7a5b7f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "470fd7a5b7f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-18-27-17613-43-13-45,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789766391, "last_seen": 1789766391, "transport": "t", "ja3_hash": "dc96c1aa469ed779dac2047285fcfbb8", "ja3_variant_count": 1, "ja3_variants": [ "dc96c1aa469ed779dac2047285fcfbb8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 9 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_4c62a3dec0f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "4c62a3dec0f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-45-18-51-23-5-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789161303, "last_seen": 1789161303, "transport": "t", "ja3_hash": "72d367a65f2ab2c5700b068e1defab2b", "ja3_variant_count": 1, "ja3_variants": [ "72d367a65f2ab2c5700b068e1defab2b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_50a562f80a92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "50a562f80a92", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-10-5-51764-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789635391, "last_seen": 1789635391, "transport": "t", "ja3_hash": "4bb2e5441ec8a59e5b00f31a59a665f9", "ja3_variant_count": 1, "ja3_variants": [ "4bb2e5441ec8a59e5b00f31a59a665f9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_7dd4f199b43a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "7dd4f199b43a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-65281-43-35-23-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789882837, "last_seen": 1789882837, "transport": "t", "ja3_hash": "c2c0a2bff2963910811c6f0e3ef98983", "ja3_variant_count": 1, "ja3_variants": [ "c2c0a2bff2963910811c6f0e3ef98983" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_825b3d2a77c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "825b3d2a77c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-23-43-45-5-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788773883, "last_seen": 1788773883, "transport": "t", "ja3_hash": "54642f0090aa745a668b25a349d58f68", "ja3_variant_count": 1, "ja3_variants": [ "54642f0090aa745a668b25a349d58f68" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_854398f86dae", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "854398f86dae", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-17613-10-35-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789482784, "last_seen": 1789482784, "transport": "t", "ja3_hash": "06e944b3e4d8d61904d87410007f1eb4", "ja3_variant_count": 1, "ja3_variants": [ "06e944b3e4d8d61904d87410007f1eb4" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/133.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_8db08fe09f65", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "8db08fe09f65", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-43-11-5-18-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788848442, "last_seen": 1788848442, "transport": "t", "ja3_hash": "21e68a33e497aa2e3778ecdbe0320a2d", "ja3_variant_count": 1, "ja3_variants": [ "21e68a33e497aa2e3778ecdbe0320a2d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_92f7105013cc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "92f7105013cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-10-23-45-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789690508, "last_seen": 1789690508, "transport": "t", "ja3_hash": "935ca81bab02ef9292660d24515fc739", "ja3_variant_count": 1, "ja3_variants": [ "935ca81bab02ef9292660d24515fc739" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_9484f0b9c43f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "9484f0b9c43f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-43-17613-13-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789698615, "last_seen": 1789698615, "transport": "t", "ja3_hash": "e29592edc59577cd81cd1471c1302f5a", "ja3_variant_count": 1, "ja3_variants": [ "e29592edc59577cd81cd1471c1302f5a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_9b18823f6dbd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "9b18823f6dbd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-10-51-35-5-43-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730653, "last_seen": 1789730653, "transport": "t", "ja3_hash": "9feb20784b5943cf60c209902b0630dd", "ja3_variant_count": 1, "ja3_variants": [ "9feb20784b5943cf60c209902b0630dd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_a1482d6b24e9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "a1482d6b24e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-43-51-23-65281-35-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788847021, "last_seen": 1788847021, "transport": "t", "ja3_hash": "1939ea702fe7953a68bf2bd09ed87d16", "ja3_variant_count": 1, "ja3_variants": [ "1939ea702fe7953a68bf2bd09ed87d16" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_bb1f695b2fcd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "bb1f695b2fcd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-17613-13-35-23-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789761577, "last_seen": 1789761577, "transport": "t", "ja3_hash": "3455bf75b7e41235690c999972600651", "ja3_variant_count": 1, "ja3_variants": [ "3455bf75b7e41235690c999972600651" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.2941.68 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_bdb84f149853", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "bdb84f149853", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-5-27-23-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789381790, "last_seen": 1789381790, "transport": "t", "ja3_hash": "434c101e463fb28549631940adca76be", "ja3_variant_count": 1, "ja3_variants": [ "434c101e463fb28549631940adca76be" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_c6cb37701b45", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "c6cb37701b45", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-35-17613-27-65281-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788769950, "last_seen": 1788769950, "transport": "t", "ja3_hash": "09d68a56deace160fbf36a177ae2b2f7", "ja3_variant_count": 1, "ja3_variants": [ "09d68a56deace160fbf36a177ae2b2f7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_d6a5d8d0e978", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "d6a5d8d0e978", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-11-51-18-43-35-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788848238, "last_seen": 1788848238, "transport": "t", "ja3_hash": "c3edd3ec4c01ab391a01b7fd177e8f2d", "ja3_variant_count": 1, "ja3_variants": [ "c3edd3ec4c01ab391a01b7fd177e8f2d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_e9b7e720556c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "e9b7e720556c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-65037-5-65281-27-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788816322, "last_seen": 1788816322, "transport": "t", "ja3_hash": "a6d547ba49f7489b56a0f1111bba0ede", "ja3_variant_count": 1, "ja3_variants": [ "a6d547ba49f7489b56a0f1111bba0ede" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_2024fd07f62f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "2024fd07f62f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-18-65037-43-5-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788797847, "last_seen": 1788797847, "transport": "t", "ja3_hash": "632c697079a785b180f04c83369f4d26", "ja3_variant_count": 1, "ja3_variants": [ "632c697079a785b180f04c83369f4d26" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_3edd108ea731", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "3edd108ea731", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-5-43-17613-65281-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789689012, "last_seen": 1789689012, "transport": "t", "ja3_hash": "413466cc77b327228122f04a3f728812", "ja3_variant_count": 1, "ja3_variants": [ "413466cc77b327228122f04a3f728812" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_664d3adf355c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "664d3adf355c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-43-16-35-17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788831997, "last_seen": 1788831997, "transport": "t", "ja3_hash": "26853a243449d8f042a964e419512091", "ja3_variant_count": 1, "ja3_variants": [ "26853a243449d8f042a964e419512091" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_6bc6d2d9a3b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "6bc6d2d9a3b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-11-43-27-16-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789928991, "last_seen": 1789928991, "transport": "t", "ja3_hash": "7037ded95d2cabacbb2bdb3d3e534aa8", "ja3_variant_count": 1, "ja3_variants": [ "7037ded95d2cabacbb2bdb3d3e534aa8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_6c51202144b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "6c51202144b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-65281-16-43-18-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789056524, "last_seen": 1789056524, "transport": "t", "ja3_hash": "781a9e326d47fd005dd21ae8a1fc581e", "ja3_variant_count": 1, "ja3_variants": [ "781a9e326d47fd005dd21ae8a1fc581e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_6eec34b0c163", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "6eec34b0c163", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-17613-10-16-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788620877, "last_seen": 1788620877, "transport": "t", "ja3_hash": "77d4c9e32097e00498b153be8a286afb", "ja3_variant_count": 1, "ja3_variants": [ "77d4c9e32097e00498b153be8a286afb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_896f8fd8b012", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "896f8fd8b012", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-17613-43-18-10-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789292870, "last_seen": 1789292870, "transport": "t", "ja3_hash": "33e8587dc7b7c7d81afd0e61cabef4e0", "ja3_variant_count": 1, "ja3_variants": [ "33e8587dc7b7c7d81afd0e61cabef4e0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_a5cdebaf66ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "a5cdebaf66ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-5-35-13-43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789849732, "last_seen": 1789849732, "transport": "t", "ja3_hash": "6a2b7390df3a95fef686e7d9ee3cc329", "ja3_variant_count": 1, "ja3_variants": [ "6a2b7390df3a95fef686e7d9ee3cc329" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_b25aea451ce0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "b25aea451ce0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-16-11-65281-43-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788769309, "last_seen": 1788769309, "transport": "t", "ja3_hash": "f69b4b8f9c51d6c4b24e542ca651d1de", "ja3_variant_count": 1, "ja3_variants": [ "f69b4b8f9c51d6c4b24e542ca651d1de" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_b8f51d14fad6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "b8f51d14fad6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-65281-18-65037-23-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788796776, "last_seen": 1788796776, "transport": "t", "ja3_hash": "6c9e4965f5dacced726d65e5d848b3bb", "ja3_variant_count": 1, "ja3_variants": [ "6c9e4965f5dacced726d65e5d848b3bb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_bee4687425bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "bee4687425bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-18-65281-51-5-16-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789047165, "last_seen": 1789047165, "transport": "t", "ja3_hash": "b95e696ef10b51ff179ede26ad7c0555", "ja3_variant_count": 1, "ja3_variants": [ "b95e696ef10b51ff179ede26ad7c0555" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_c0dd755a67c0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "c0dd755a67c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-45-18-65281-23-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789812189, "last_seen": 1789812189, "transport": "t", "ja3_hash": "60dd8328d6f5e461d0938bdf794c3b4a", "ja3_variant_count": 1, "ja3_variants": [ "60dd8328d6f5e461d0938bdf794c3b4a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 OPR/119.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_fea3baef3968", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "fea3baef3968", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-13-43-16-27-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788738737, "last_seen": 1788738737, "transport": "t", "ja3_hash": "315df1467560c20dc1a2d7d90618fd5c", "ja3_variant_count": 1, "ja3_variants": [ "315df1467560c20dc1a2d7d90618fd5c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 8 }, "ua_disagreement": false } }, { "hash": "t13i1508ht_8daaf6152771_01e319b55bde", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508ht", "b": "8daaf6152771", "c": "01e319b55bde", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-5-43-18-16-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789633542, "last_seen": 1789633542, "transport": "t", "ja3_hash": "7f1d41a27faea0ab6a0db481de27a4f9", "ja3_variant_count": 1, "ja3_variants": [ "7f1d41a27faea0ab6a0db481de27a4f9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508ht_8daaf6152771_5d9354995189", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508ht", "b": "8daaf6152771", "c": "5d9354995189", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-11-18-23-51-5-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789878466, "last_seen": 1789878466, "transport": "t", "ja3_hash": "d3f7865426df67bb9bf5bd0b7a0525f4", "ja3_variant_count": 1, "ja3_variants": [ "d3f7865426df67bb9bf5bd0b7a0525f4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508ht_8daaf6152771_f6207674c900", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508ht", "b": "8daaf6152771", "c": "f6207674c900", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-5-16-51-65281-23-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789964829, "last_seen": 1789964829, "transport": "t", "ja3_hash": "cc2c5c3274f0d9fc44e4b83809a205dc", "ja3_variant_count": 1, "ja3_variants": [ "cc2c5c3274f0d9fc44e4b83809a205dc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_136f5a52b485", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "136f5a52b485", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-5-27-65281-43-45-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788839100, "last_seen": 1789950627, "transport": "t", "ja3_hash": "f85fb3577182048f00064cbe5612d7bf", "ja3_variant_count": 2, "ja3_variants": [ "f85fb3577182048f00064cbe5612d7bf", "ca1264c020d92115e88cb7785f0bca4d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_169c43f0c655", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "169c43f0c655", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-10-43-27-5-35-45-18,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789455560, "last_seen": 1789455560, "transport": "t", "ja3_hash": "7ca7dba3ef2f5874f295df86bb9c7f05", "ja3_variant_count": 1, "ja3_variants": [ "7ca7dba3ef2f5874f295df86bb9c7f05" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_18e8a06d9b2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "18e8a06d9b2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-11-35-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789527589, "last_seen": 1789572800, "transport": "t", "ja3_hash": "02fc9e6401d2c8c1bf8f91bd21b8e17e", "ja3_variant_count": 1, "ja3_variants": [ "02fc9e6401d2c8c1bf8f91bd21b8e17e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_1b787d9203d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "1b787d9203d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-35-45-18-23-5-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788820508, "last_seen": 1789398568, "transport": "t", "ja3_hash": "bd0171072729aad9cafe25295b44914c", "ja3_variant_count": 2, "ja3_variants": [ "bd0171072729aad9cafe25295b44914c", "21bf29d13870b8ba753c665a03c79197" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_24fee6b10870", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "24fee6b10870", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-23-45-43-65281-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788861561, "last_seen": 1788861561, "transport": "t", "ja3_hash": "ad81501d8763ffbd8ac86934e7dbd599", "ja3_variant_count": 1, "ja3_variants": [ "ad81501d8763ffbd8ac86934e7dbd599" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_31339261f2c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "31339261f2c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-65281-11-17613-18-10-43-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789457620, "last_seen": 1789457620, "transport": "t", "ja3_hash": "0fc122a7eff27d6fd53dd0e8def2b75f", "ja3_variant_count": 1, "ja3_variants": [ "0fc122a7eff27d6fd53dd0e8def2b75f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_3d624f8550f9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "3d624f8550f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-13-17613-11-51-43-35-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789778225, "last_seen": 1789778225, "transport": "t", "ja3_hash": "fab5b188f23c8fc258e960e07130b66a", "ja3_variant_count": 1, "ja3_variants": [ "fab5b188f23c8fc258e960e07130b66a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_3f98e0d6e645", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "3f98e0d6e645", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-5-11-43-51-23-65281-16,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788830042, "last_seen": 1788830042, "transport": "t", "ja3_hash": "a0d6f7799b4df14321b68808849851bb", "ja3_variant_count": 1, "ja3_variants": [ "a0d6f7799b4df14321b68808849851bb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_58313540c316", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "58313540c316", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-35-51-43-18-27-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788809100, "last_seen": 1788809100, "transport": "t", "ja3_hash": "9bda882451b95228d0b0de37ebb28f6d", "ja3_variant_count": 1, "ja3_variants": [ "9bda882451b95228d0b0de37ebb28f6d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_956264f26fea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "956264f26fea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-10-43-65281-5-13-18-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789882122, "last_seen": 1789882122, "transport": "t", "ja3_hash": "337efb5e3dba3b1485427ca276198678", "ja3_variant_count": 1, "ja3_variants": [ "337efb5e3dba3b1485427ca276198678" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_962dce9d9db9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "962dce9d9db9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-23-13-11-43-45-51-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788830038, "last_seen": 1788830038, "transport": "t", "ja3_hash": "d9278752ecc207b05e3efc0a44c0199a", "ja3_variant_count": 1, "ja3_variants": [ "d9278752ecc207b05e3efc0a44c0199a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_a27cdad178a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "a27cdad178a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-43-65037-45-18-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788962828, "last_seen": 1788962828, "transport": "t", "ja3_hash": "69524524783523778b9f2eb0079cd85a", "ja3_variant_count": 1, "ja3_variants": [ "69524524783523778b9f2eb0079cd85a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_bb563522fc3c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "bb563522fc3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-23-65281-5-27-11-43-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789155743, "last_seen": 1789155743, "transport": "t", "ja3_hash": "788627c591c30c612a5db85b392f2be4", "ja3_variant_count": 1, "ja3_variants": [ "788627c591c30c612a5db85b392f2be4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_c3134a358148", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "c3134a358148", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-51-11-23-45-43-5-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788724243, "last_seen": 1788724243, "transport": "t", "ja3_hash": "5d7123e9bf111087d6910b4de50b9550", "ja3_variant_count": 1, "ja3_variants": [ "5d7123e9bf111087d6910b4de50b9550" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_c693b9784a07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "c693b9784a07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-18-65281-10-51-35-17613-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788459876, "last_seen": 1788459876, "transport": "t", "ja3_hash": "a51b9a2d9bb6aa744c6e3909c6351c2d", "ja3_variant_count": 1, "ja3_variants": [ "a51b9a2d9bb6aa744c6e3909c6351c2d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_e5dc7e7bac65", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "e5dc7e7bac65", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-65281-17613-5-65037-43-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789533253, "last_seen": 1789910591, "transport": "t", "ja3_hash": "6bceed5bbbb2cb1c77a07fa356e7b193", "ja3_variant_count": 2, "ja3_variants": [ "6bceed5bbbb2cb1c77a07fa356e7b193", "240383522d0dda6d127060c8b623b8d8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_ec4389d4719b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "ec4389d4719b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-11-65037-27-65281-45-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789124628, "last_seen": 1789124628, "transport": "t", "ja3_hash": "7f61e2bea3f8d989d7ae8efd7fc2b873", "ja3_variant_count": 1, "ja3_variants": [ "7f61e2bea3f8d989d7ae8efd7fc2b873" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 11 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_082737226558", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "082737226558", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-45-65281-27-23-16-51-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789457143, "last_seen": 1789457143, "transport": "t", "ja3_hash": "a962ea441e614d559688d8b3e9e780ae", "ja3_variant_count": 1, "ja3_variants": [ "a962ea441e614d559688d8b3e9e780ae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_1146970dabcc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "1146970dabcc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-13-45-11-43-5-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789613782, "last_seen": 1789613782, "transport": "t", "ja3_hash": "290021a3f337b661ee32d8c38c8c278d", "ja3_variant_count": 1, "ja3_variants": [ "290021a3f337b661ee32d8c38c8c278d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_2a211ab5dcdd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "2a211ab5dcdd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-13-17613-43-5-16-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789098858, "last_seen": 1789098858, "transport": "t", "ja3_hash": "2c3d55929368a8d481fe5ee2d82b9680", "ja3_variant_count": 1, "ja3_variants": [ "2c3d55929368a8d481fe5ee2d82b9680" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_348496746a52", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "348496746a52", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-18-10-43-45-23-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788773012, "last_seen": 1788773012, "transport": "t", "ja3_hash": "f0a71397aeb21f4e594532ed54937390", "ja3_variant_count": 1, "ja3_variants": [ "f0a71397aeb21f4e594532ed54937390" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_38e3ddd3bdd3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "38e3ddd3bdd3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-16-27-35-13-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788622089, "last_seen": 1788622089, "transport": "t", "ja3_hash": "e61d7897bb407eb719b222855ce4a255", "ja3_variant_count": 1, "ja3_variants": [ "e61d7897bb407eb719b222855ce4a255" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_3eb03e6ed44f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "3eb03e6ed44f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-18-16-5-17613-35-65281-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789327254, "last_seen": 1789327254, "transport": "t", "ja3_hash": "af9827eb91637c74183519ad4af8cb9c", "ja3_variant_count": 1, "ja3_variants": [ "af9827eb91637c74183519ad4af8cb9c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_52f7f2e3e7bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "52f7f2e3e7bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-17613-16-43-18-13-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788794964, "last_seen": 1788794964, "transport": "t", "ja3_hash": "2da4acfddf5e94ac2585953989c63f33", "ja3_variant_count": 1, "ja3_variants": [ "2da4acfddf5e94ac2585953989c63f33" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_5c07be71c360", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "5c07be71c360", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-17613-65037-16-13-43-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789869227, "last_seen": 1789869227, "transport": "t", "ja3_hash": "bb6d036656cc79f959e701e99c85ad57", "ja3_variant_count": 1, "ja3_variants": [ "bb6d036656cc79f959e701e99c85ad57" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_74edabe0f5d9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "74edabe0f5d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-16-17613-18-11-5-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789354746, "last_seen": 1789354746, "transport": "t", "ja3_hash": "f6bfe4c8dfc0a7f48dc06ae8a05721a9", "ja3_variant_count": 1, "ja3_variants": [ "f6bfe4c8dfc0a7f48dc06ae8a05721a9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_bbdcaf8036bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "bbdcaf8036bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-16-65281-13-17613-18-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789665118, "last_seen": 1789665118, "transport": "t", "ja3_hash": "045aef86fc5de5a37456b6278421e34b", "ja3_variant_count": 1, "ja3_variants": [ "045aef86fc5de5a37456b6278421e34b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_e68e9a819b76", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "e68e9a819b76", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-65281-65037-35-10-16-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789704279, "last_seen": 1789704279, "transport": "t", "ja3_hash": "11ee33d3b83d4b6f5e5820ef022ab2bf", "ja3_variant_count": 1, "ja3_variants": [ "11ee33d3b83d4b6f5e5820ef022ab2bf" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509ht_8daaf6152771_0fadd28faa7f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509ht", "b": "8daaf6152771", "c": "0fadd28faa7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-65037-11-23-16-43-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789798910, "last_seen": 1789798910, "transport": "t", "ja3_hash": "1b7224cf060d39ff12fa27a93400be49", "ja3_variant_count": 1, "ja3_variants": [ "1b7224cf060d39ff12fa27a93400be49" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509ht_8daaf6152771_1f2d4af2dafe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509ht", "b": "8daaf6152771", "c": "1f2d4af2dafe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-43-10-27-45-16-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789153199, "last_seen": 1789153199, "transport": "t", "ja3_hash": "1f5cb3bc201e299a29b89caa434867ab", "ja3_variant_count": 1, "ja3_variants": [ "1f5cb3bc201e299a29b89caa434867ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509ht_8daaf6152771_7266c4078926", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509ht", "b": "8daaf6152771", "c": "7266c4078926", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-35-16-65037-27-65281-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789966152, "last_seen": 1789966152, "transport": "t", "ja3_hash": "9b343da2b101dea9619212fa90ffd19d", "ja3_variant_count": 1, "ja3_variants": [ "9b343da2b101dea9619212fa90ffd19d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_0480efd56e7d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "0480efd56e7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-11-35-10-23-13-43-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789017999, "last_seen": 1789017999, "transport": "t", "ja3_hash": "814857f18ea3c74352eefe08b3b4f2b5", "ja3_variant_count": 1, "ja3_variants": [ "814857f18ea3c74352eefe08b3b4f2b5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_07d4c546ea27", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "07d4c546ea27", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-45-35-10-43-23-17613-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788744461, "last_seen": 1788744461, "transport": "t", "ja3_hash": "18f64a4777f2e8d7e61d625f08110a91", "ja3_variant_count": 1, "ja3_variants": [ "18f64a4777f2e8d7e61d625f08110a91" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_0b790480e98e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "0b790480e98e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-13-65281-10-23-5-35-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789416943, "last_seen": 1789416943, "transport": "t", "ja3_hash": "a714a2dedb4c230e7267d7b41687ef58", "ja3_variant_count": 1, "ja3_variants": [ "a714a2dedb4c230e7267d7b41687ef58" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_1f5259b7c27f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "1f5259b7c27f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-5-18-65281-13-65037-43-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789613755, "last_seen": 1789613755, "transport": "t", "ja3_hash": "e09a92945119e9a7c13b056d4be063ca", "ja3_variant_count": 1, "ja3_variants": [ "e09a92945119e9a7c13b056d4be063ca" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_25060c2801cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "25060c2801cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-13-35-65281-45-43-17613-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788779846, "last_seen": 1789681479, "transport": "t", "ja3_hash": "84474d8668435474b3a7099b77c968a3", "ja3_variant_count": 2, "ja3_variants": [ "84474d8668435474b3a7099b77c968a3", "02384f34fffb93cc7bf77fb08f2e66f9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_5c470b4c6c88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "5c470b4c6c88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-27-35-23-10-13-18-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788789366, "last_seen": 1788789366, "transport": "t", "ja3_hash": "3ce090e20d70343f4f614a4b8a58b6cd", "ja3_variant_count": 1, "ja3_variants": [ "3ce090e20d70343f4f614a4b8a58b6cd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_68d52dacf6e6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "68d52dacf6e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-43-65281-10-5-65037-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788857813, "last_seen": 1788857813, "transport": "t", "ja3_hash": "8aba27b5d7c4ca2a854fe5d26e4ff9cf", "ja3_variant_count": 1, "ja3_variants": [ "8aba27b5d7c4ca2a854fe5d26e4ff9cf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_742f84ecedf8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "742f84ecedf8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-13-18-65281-23-35-43-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788704898, "last_seen": 1788704898, "transport": "t", "ja3_hash": "0ef6e8f0fd1efa161c3d8f271f4c9201", "ja3_variant_count": 1, "ja3_variants": [ "0ef6e8f0fd1efa161c3d8f271f4c9201" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_7786f0f3f384", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "7786f0f3f384", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-10-17613-5-43-13-45-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789330069, "last_seen": 1789330069, "transport": "t", "ja3_hash": "e3c6131d481e716625c720b9dd1f3d65", "ja3_variant_count": 1, "ja3_variants": [ "e3c6131d481e716625c720b9dd1f3d65" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_8acea6979e16", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "8acea6979e16", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-27-65037-13-18-43-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789849657, "last_seen": 1789849657, "transport": "t", "ja3_hash": "5cc4100496ea8e4f23f7aad6485466c0", "ja3_variant_count": 1, "ja3_variants": [ "5cc4100496ea8e4f23f7aad6485466c0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_8afb3a864bbc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "8afb3a864bbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-27-51764-23-13-65037-18-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788499360, "last_seen": 1788499360, "transport": "t", "ja3_hash": "5ca8353e8de2a60eabde5cbce9d9692a", "ja3_variant_count": 1, "ja3_variants": [ "5ca8353e8de2a60eabde5cbce9d9692a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_92fd269a5148", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "92fd269a5148", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-11-5-10-65037-45-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789867049, "last_seen": 1789867049, "transport": "t", "ja3_hash": "1f5945928e0a3630c867556698dad476", "ja3_variant_count": 1, "ja3_variants": [ "1f5945928e0a3630c867556698dad476" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_990cf36d01db", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "990cf36d01db", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-5-11-23-13-65281-43-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789635490, "last_seen": 1789635490, "transport": "t", "ja3_hash": "0f3cac440ac7a653c83bfbd7e1c9be92", "ja3_variant_count": 1, "ja3_variants": [ "0f3cac440ac7a653c83bfbd7e1c9be92" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_a03f38a30f75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "a03f38a30f75", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-51-65281-11-23-10-27-43-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789647942, "last_seen": 1789647942, "transport": "t", "ja3_hash": "26629cab00b8853f13bcbb72435e9a8f", "ja3_variant_count": 1, "ja3_variants": [ "26629cab00b8853f13bcbb72435e9a8f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_b2df4b604e4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "b2df4b604e4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-45-35-27-5-65037-13-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789011498, "last_seen": 1789011498, "transport": "t", "ja3_hash": "ba3890555fd9720b476b8af2de02c3ab", "ja3_variant_count": 1, "ja3_variants": [ "ba3890555fd9720b476b8af2de02c3ab" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_c99b756607d9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "c99b756607d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-35-65281-10-18-51-23-17613-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789537596, "last_seen": 1789537596, "transport": "t", "ja3_hash": "402ad77e5269d19e68b5572a5c941a55", "ja3_variant_count": 1, "ja3_variants": [ "402ad77e5269d19e68b5572a5c941a55" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.7778.96 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_cb8f23c345ea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "cb8f23c345ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-43-23-11-65037-65281-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789267482, "last_seen": 1789267482, "transport": "t", "ja3_hash": "86018a434acd882f2514c931de665c1d", "ja3_variant_count": 1, "ja3_variants": [ "86018a434acd882f2514c931de665c1d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Vivaldi/7.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_d911c8dfd53d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "d911c8dfd53d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-35-17613-10-51-45-18-65281-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788550152, "last_seen": 1788550152, "transport": "t", "ja3_hash": "c97efa4c809867fc5b044adea135273d", "ja3_variant_count": 1, "ja3_variants": [ "c97efa4c809867fc5b044adea135273d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 19 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_dbebe983155f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "dbebe983155f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-65281-11-45-35-18-27-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788959686, "last_seen": 1788959686, "transport": "t", "ja3_hash": "4e0d0c106a3e1ef3e816940a1701aba7", "ja3_variant_count": 1, "ja3_variants": [ "4e0d0c106a3e1ef3e816940a1701aba7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_dd1445eb6ebf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "dd1445eb6ebf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-23-17613-65037-10-5-65281-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789063164, "last_seen": 1789063164, "transport": "t", "ja3_hash": "c575514322ebf77d6f28021ccbde967e", "ja3_variant_count": 1, "ja3_variants": [ "c575514322ebf77d6f28021ccbde967e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_e558674a30f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "e558674a30f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-35-13-45-10-65281-43-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789635372, "last_seen": 1789635372, "transport": "t", "ja3_hash": "7e25c56f03841cc84ec6ab99a0752bd7", "ja3_variant_count": 1, "ja3_variants": [ "7e25c56f03841cc84ec6ab99a0752bd7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_e77ed8dc1429", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "e77ed8dc1429", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-27-65037-5-35-65281-45-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789629750, "last_seen": 1789629750, "transport": "t", "ja3_hash": "bdf2daff882c4eeab6e3716b08a00658", "ja3_variant_count": 1, "ja3_variants": [ "bdf2daff882c4eeab6e3716b08a00658" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_eb513c3e0717", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "eb513c3e0717", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-5-11-23-35-10-65037-65281-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788847805, "last_seen": 1788847805, "transport": "t", "ja3_hash": "4f85e5691c596f3cbcb6d153843e90b5", "ja3_variant_count": 1, "ja3_variants": [ "4f85e5691c596f3cbcb6d153843e90b5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_f2ad119d8bc9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "f2ad119d8bc9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-45-65281-43-18-35-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788781233, "last_seen": 1788781233, "transport": "t", "ja3_hash": "2c536d8883bce1723a2591348a3775d9", "ja3_variant_count": 1, "ja3_variants": [ "2c536d8883bce1723a2591348a3775d9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_f4dfcdddf392", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "f4dfcdddf392", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-13-27-43-10-23-5-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788790370, "last_seen": 1788790370, "transport": "t", "ja3_hash": "a7fcaaf762f90b89f10d5f3db003f337", "ja3_variant_count": 1, "ja3_variants": [ "a7fcaaf762f90b89f10d5f3db003f337" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_08ecd3b10d9e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "08ecd3b10d9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-23-18-13-65281-16-5-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789695429, "last_seen": 1789695429, "transport": "t", "ja3_hash": "abfcd164f22c493d2fc59f419e3c9939", "ja3_variant_count": 1, "ja3_variants": [ "abfcd164f22c493d2fc59f419e3c9939" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_0b7e5b2c516e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "0b7e5b2c516e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-35-18-16-45-5-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789837741, "last_seen": 1789837741, "transport": "t", "ja3_hash": "ab317a5329b8f1c966cd99e0918f5507", "ja3_variant_count": 1, "ja3_variants": [ "ab317a5329b8f1c966cd99e0918f5507" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 6 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_17f6d9f85e1d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "17f6d9f85e1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-16-11-35-5-10-17613-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508295, "last_seen": 1788508295, "transport": "t", "ja3_hash": "47a606a914d3d72902d1e7aff20c5472", "ja3_variant_count": 1, "ja3_variants": [ "47a606a914d3d72902d1e7aff20c5472" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_199aa72fe2b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "199aa72fe2b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-43-11-65281-35-5-16-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788779555, "last_seen": 1788779555, "transport": "t", "ja3_hash": "4f2e61b033911f277f6cfab73ed061bc", "ja3_variant_count": 1, "ja3_variants": [ "4f2e61b033911f277f6cfab73ed061bc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_21459a9612e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "21459a9612e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-43-16-5-13-65281-45-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789696996, "last_seen": 1789696996, "transport": "t", "ja3_hash": "09575c72e0cd71728d0bb42604b9c58e", "ja3_variant_count": 1, "ja3_variants": [ "09575c72e0cd71728d0bb42604b9c58e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_273ed36db397", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "273ed36db397", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-43-18-17613-45-13-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788825886, "last_seen": 1788825886, "transport": "t", "ja3_hash": "8bcead03d0414de8d7a66069cecbec9f", "ja3_variant_count": 1, "ja3_variants": [ "8bcead03d0414de8d7a66069cecbec9f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 33 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_2e3f9fd495b4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "2e3f9fd495b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-18-65037-35-16-10-43-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789396358, "last_seen": 1789396358, "transport": "t", "ja3_hash": "c8f545583c2c9ed2a740472f726be6b0", "ja3_variant_count": 1, "ja3_variants": [ "c8f545583c2c9ed2a740472f726be6b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_3d03bdfe82c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "3d03bdfe82c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-23-43-45-16-35-13-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789267402, "last_seen": 1789267402, "transport": "t", "ja3_hash": "f5fb6cef4d44a06607d96f6feb3904fc", "ja3_variant_count": 1, "ja3_variants": [ "f5fb6cef4d44a06607d96f6feb3904fc" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_42cd88e06348", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "42cd88e06348", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-18-16-17613-65281-51764-35-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789479769, "last_seen": 1789479769, "transport": "t", "ja3_hash": "466daf093c486ac51262fbf3a5d066f8", "ja3_variant_count": 1, "ja3_variants": [ "466daf093c486ac51262fbf3a5d066f8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_4324905969a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "4324905969a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-17613-27-18-35-16-5-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789613599, "last_seen": 1789613599, "transport": "t", "ja3_hash": "3b97a9dc1de3dce7e5e692b71708d666", "ja3_variant_count": 1, "ja3_variants": [ "3b97a9dc1de3dce7e5e692b71708d666" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_4e68cdb5f915", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "4e68cdb5f915", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-16-65037-43-10-5-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789928875, "last_seen": 1789928875, "transport": "t", "ja3_hash": "d07d5953a3efb48b7f405ec3dcee9d7f", "ja3_variant_count": 1, "ja3_variants": [ "d07d5953a3efb48b7f405ec3dcee9d7f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_63cd8f3e8102", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "63cd8f3e8102", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-10-11-16-23-27-13-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788511552, "last_seen": 1788511552, "transport": "t", "ja3_hash": "3d8b142c8a4a934cc87bb10c6781d43f", "ja3_variant_count": 1, "ja3_variants": [ "3d8b142c8a4a934cc87bb10c6781d43f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_66a30c8f921c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "66a30c8f921c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-18-16-27-35-11-65281-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789172612, "last_seen": 1789172612, "transport": "t", "ja3_hash": "24a1753d512a68ebdb909b183c1b0348", "ja3_variant_count": 1, "ja3_variants": [ "24a1753d512a68ebdb909b183c1b0348" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_87c600696bdb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "87c600696bdb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-11-17613-5-13-23-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789967046, "last_seen": 1789967046, "transport": "t", "ja3_hash": "8527d6800760eefd83f89503d3c10131", "ja3_variant_count": 1, "ja3_variants": [ "8527d6800760eefd83f89503d3c10131" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_8966843b4b06", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "8966843b4b06", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-10-16-43-11-45-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789396339, "last_seen": 1789396339, "transport": "t", "ja3_hash": "3cc17e9f4661297709c5c137c48c3677", "ja3_variant_count": 1, "ja3_variants": [ "3cc17e9f4661297709c5c137c48c3677" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_93e3d6013cee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "93e3d6013cee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-10-17613-27-18-5-43-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789757233, "last_seen": 1789757233, "transport": "t", "ja3_hash": "d087d914a41be7b441e868ad4923a676", "ja3_variant_count": 1, "ja3_variants": [ "d087d914a41be7b441e868ad4923a676" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_9b0ed6256b93", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "9b0ed6256b93", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-5-16-65037-10-35-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789168643, "last_seen": 1789168643, "transport": "t", "ja3_hash": "ea846969b61e358d5e4402a7792f33b0", "ja3_variant_count": 1, "ja3_variants": [ "ea846969b61e358d5e4402a7792f33b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_b18ba6013cf2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "b18ba6013cf2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-16-27-43-65281-35-13-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788634420, "last_seen": 1788634420, "transport": "t", "ja3_hash": "f259cf2e9bed3921a6ada917e43239c7", "ja3_variant_count": 1, "ja3_variants": [ "f259cf2e9bed3921a6ada917e43239c7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_c21e6828b5da", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "c21e6828b5da", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-23-16-13-18-65037-43-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789678842, "last_seen": 1789678842, "transport": "t", "ja3_hash": "9bf2bf82ca0568b5ec48e8bb13d77962", "ja3_variant_count": 1, "ja3_variants": [ "9bf2bf82ca0568b5ec48e8bb13d77962" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_c2c1483eb662", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "c2c1483eb662", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-27-45-17613-13-65281-23-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789511320, "last_seen": 1789511320, "transport": "t", "ja3_hash": "3021c89ac6c2bd122d2ed0a838a59ec6", "ja3_variant_count": 1, "ja3_variants": [ "3021c89ac6c2bd122d2ed0a838a59ec6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 122 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_f52e57363943", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "f52e57363943", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-65281-43-65037-27-45-16-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789142098, "last_seen": 1789142098, "transport": "t", "ja3_hash": "5a3a1dd6a3202ad2acf895203482a45a", "ja3_variant_count": 1, "ja3_variants": [ "5a3a1dd6a3202ad2acf895203482a45a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 28 }, "ua_disagreement": false } }, { "hash": "t13i1510ht_8daaf6152771_8d0f19545b8f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510ht", "b": "8daaf6152771", "c": "8d0f19545b8f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-45-43-65281-35-18-5-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788882016, "last_seen": 1788882016, "transport": "t", "ja3_hash": "ff8cb431afcbea6c85f764c11660a0b2", "ja3_variant_count": 1, "ja3_variants": [ "ff8cb431afcbea6c85f764c11660a0b2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_0c4844a68e2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "0c4844a68e2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-65037-18-35-10-45-11-65281-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789634747, "last_seen": 1789634747, "transport": "t", "ja3_hash": "cc3257824ec9ee4a40f011004f429e41", "ja3_variant_count": 1, "ja3_variants": [ "cc3257824ec9ee4a40f011004f429e41" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_123f32514b5a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "123f32514b5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-13-17613-65037-18-23-11-65281-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789811908, "last_seen": 1789811908, "transport": "t", "ja3_hash": "4c4bef22f22c121ff8ade6e79bdfe3d4", "ja3_variant_count": 1, "ja3_variants": [ "4c4bef22f22c121ff8ade6e79bdfe3d4" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_1983395afe0a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "1983395afe0a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-45-10-43-18-11-17613-65281-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788804555, "last_seen": 1788804555, "transport": "t", "ja3_hash": "c24d26db8983ccb7f67c72d41c1e641b", "ja3_variant_count": 1, "ja3_variants": [ "c24d26db8983ccb7f67c72d41c1e641b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_38daa66b4cac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "38daa66b4cac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-5-65037-35-10-45-11-27-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789482722, "last_seen": 1789482722, "transport": "t", "ja3_hash": "c606cee445d8aedb0035b5d07d58cf91", "ja3_variant_count": 1, "ja3_variants": [ "c606cee445d8aedb0035b5d07d58cf91" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_5ad77a56a781", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "5ad77a56a781", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-35-10-17613-51764-18-5-13-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788967869, "last_seen": 1788967869, "transport": "t", "ja3_hash": "84c5e06ade7fa8e3a82ab26b675e3ae6", "ja3_variant_count": 1, "ja3_variants": [ "84c5e06ade7fa8e3a82ab26b675e3ae6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_8ef772727c1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "8ef772727c1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-23-13-45-11-43-18-10-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730637, "last_seen": 1789730637, "transport": "t", "ja3_hash": "cee3a38c7e6b39237838e4ed708ceee0", "ja3_variant_count": 1, "ja3_variants": [ "cee3a38c7e6b39237838e4ed708ceee0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_bca5e4ad5b5c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "bca5e4ad5b5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-45-35-23-5-11-27-65037-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788805023, "last_seen": 1788805023, "transport": "t", "ja3_hash": "1a47bfc565913edfca5b519afa447b04", "ja3_variant_count": 1, "ja3_variants": [ "1a47bfc565913edfca5b519afa447b04" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_bd4d7887201a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "bd4d7887201a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-43-17613-23-11-5-35-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788614172, "last_seen": 1788614172, "transport": "t", "ja3_hash": "c2688d9a7deb9e5b15fc72d3af03784f", "ja3_variant_count": 1, "ja3_variants": [ "c2688d9a7deb9e5b15fc72d3af03784f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_dc7be83b3985", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "dc7be83b3985", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-51-18-45-23-27-35-17613-5-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789943460, "last_seen": 1789943460, "transport": "t", "ja3_hash": "d8bde08b556f6dd9ebac864fd0a0f15a", "ja3_variant_count": 1, "ja3_variants": [ "d8bde08b556f6dd9ebac864fd0a0f15a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_de0cd3be6c5b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "de0cd3be6c5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-10-5-27-11-13-23-65281-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788485078, "last_seen": 1788485078, "transport": "t", "ja3_hash": "f045a31c90d9d08cb31a56dfc5743f79", "ja3_variant_count": 1, "ja3_variants": [ "f045a31c90d9d08cb31a56dfc5743f79" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_f799b3cc17b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "f799b3cc17b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-45-5-65281-65037-23-35-13-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788791379, "last_seen": 1788791379, "transport": "t", "ja3_hash": "a80f610a601d26d8a7f8ee8316617643", "ja3_variant_count": 1, "ja3_variants": [ "a80f610a601d26d8a7f8ee8316617643" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_34b4ff0bc828", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "34b4ff0bc828", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-16-5-65281-23-18-51-45-43-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789676103, "last_seen": 1789676103, "transport": "t", "ja3_hash": "d6e9575148b86e1df8019b3383ff709d", "ja3_variant_count": 1, "ja3_variants": [ "d6e9575148b86e1df8019b3383ff709d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_358bb8095f0b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "358bb8095f0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-65037-43-11-13-35-5-45-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811262, "last_seen": 1788811262, "transport": "t", "ja3_hash": "28d56ba4334dcd239a18a002a127def8", "ja3_variant_count": 1, "ja3_variants": [ "28d56ba4334dcd239a18a002a127def8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_37f7755eec74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "37f7755eec74", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-10-23-65037-13-17613-43-18-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789950627, "last_seen": 1789950627, "transport": "t", "ja3_hash": "1d9197536931b7d0ba27f62f401de194", "ja3_variant_count": 1, "ja3_variants": [ "1d9197536931b7d0ba27f62f401de194" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_48b466c17d01", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "48b466c17d01", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-13-11-43-5-10-35-16-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789046011, "last_seen": 1789046011, "transport": "t", "ja3_hash": "286c1cbb8f0e7a44a46095518eceeb11", "ja3_variant_count": 1, "ja3_variants": [ "286c1cbb8f0e7a44a46095518eceeb11" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_646a4795d1c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "646a4795d1c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-45-16-65037-10-5-65281-43-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789402746, "last_seen": 1789402746, "transport": "t", "ja3_hash": "49fe0451e722c18e896f5f300aa14a03", "ja3_variant_count": 1, "ja3_variants": [ "49fe0451e722c18e896f5f300aa14a03" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_673fbb719607", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "673fbb719607", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-16-65037-23-10-18-43-5-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789118385, "last_seen": 1789118385, "transport": "t", "ja3_hash": "825851caa00eb1f4ad18d4effda19198", "ja3_variant_count": 1, "ja3_variants": [ "825851caa00eb1f4ad18d4effda19198" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_6910136b5ed9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "6910136b5ed9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-45-11-23-43-13-18-17613-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789104934, "last_seen": 1789104934, "transport": "t", "ja3_hash": "6c3ef8140401b4c717f54447d9e12c5d", "ja3_variant_count": 1, "ja3_variants": [ "6c3ef8140401b4c717f54447d9e12c5d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 296 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_7260fdec251a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "7260fdec251a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-23-35-65037-18-13-16-43-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789019019, "last_seen": 1789019019, "transport": "t", "ja3_hash": "e1d3c5dd0b78c315e72f65e8e11361b0", "ja3_variant_count": 1, "ja3_variants": [ "e1d3c5dd0b78c315e72f65e8e11361b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_77e543b268a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "77e543b268a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-65281-16-45-65037-35-43-23-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789659794, "last_seen": 1789659794, "transport": "t", "ja3_hash": "63c3bebcaac80eb82384c37ea4f7826a", "ja3_variant_count": 1, "ja3_variants": [ "63c3bebcaac80eb82384c37ea4f7826a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_7a1ab9bf3637", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "7a1ab9bf3637", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-13-23-17513-11-10-27-65281-16-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789124534, "last_seen": 1789124534, "transport": "t", "ja3_hash": "2d37efa571cca35e54afa183dd0191cb", "ja3_variant_count": 1, "ja3_variants": [ "2d37efa571cca35e54afa183dd0191cb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 9 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_86580dfb8573", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "86580dfb8573", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-10-43-5-18-45-65037-16-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789369484, "last_seen": 1789369484, "transport": "t", "ja3_hash": "3520a45060fc7ed2aa32afc75c13ff1d", "ja3_variant_count": 1, "ja3_variants": [ "3520a45060fc7ed2aa32afc75c13ff1d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_ba6cfc88201b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "ba6cfc88201b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-11-45-43-51764-65037-23-16-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788947869, "last_seen": 1788947869, "transport": "t", "ja3_hash": "352cb2bdd983c3aad24b97bd65a98c42", "ja3_variant_count": 1, "ja3_variants": [ "352cb2bdd983c3aad24b97bd65a98c42" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_c44049607644", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "c44049607644", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-65281-16-10-23-51764-35-18-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508431, "last_seen": 1788508431, "transport": "t", "ja3_hash": "dfc9326b7d22084d44c7ac5b535d04ae", "ja3_variant_count": 1, "ja3_variants": [ "dfc9326b7d22084d44c7ac5b535d04ae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_c8931a30a1c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "c8931a30a1c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-13-45-10-43-65037-65281-16-5-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789124472, "last_seen": 1789124472, "transport": "t", "ja3_hash": "e16062ab907e6360bd18628489c9d41f", "ja3_variant_count": 1, "ja3_variants": [ "e16062ab907e6360bd18628489c9d41f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 6 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_cb4bf42148f6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "cb4bf42148f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-23-18-5-10-16-11-65281-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788745401, "last_seen": 1788745401, "transport": "t", "ja3_hash": "0f3c4cfef5ecd134944e1c2adf0c3921", "ja3_variant_count": 1, "ja3_variants": [ "0f3c4cfef5ecd134944e1c2adf0c3921" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_de441c1a6ba5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "de441c1a6ba5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-23-18-17613-11-16-65037-45-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789691747, "last_seen": 1789691747, "transport": "t", "ja3_hash": "d737c3a94d7057580d462a13d9335619", "ja3_variant_count": 1, "ja3_variants": [ "d737c3a94d7057580d462a13d9335619" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_f3d6a55e2045", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "f3d6a55e2045", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-65037-5-43-16-45-27-23-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789617883, "last_seen": 1789617883, "transport": "t", "ja3_hash": "aa81b22a9b324959d2470687f595f5b1", "ja3_variant_count": 1, "ja3_variants": [ "aa81b22a9b324959d2470687f595f5b1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_ff438937620f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "ff438937620f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-13-65281-16-10-23-17613-18-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788655410, "last_seen": 1788655410, "transport": "t", "ja3_hash": "d65e2f35ad65fb58ae0100d2fc5dc1f8", "ja3_variant_count": 1, "ja3_variants": [ "d65e2f35ad65fb58ae0100d2fc5dc1f8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511ht_8daaf6152771_84406b474400", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511ht", "b": "8daaf6152771", "c": "84406b474400", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-13-65037-45-27-23-16-43-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788886859, "last_seen": 1788886859, "transport": "t", "ja3_hash": "de536ddf1fbdfdcec0a18beed1ef5a62", "ja3_variant_count": 1, "ja3_variants": [ "de536ddf1fbdfdcec0a18beed1ef5a62" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511ht_8daaf6152771_a7523296748d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511ht", "b": "8daaf6152771", "c": "a7523296748d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-35-18-10-45-43-5-65281-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788833086, "last_seen": 1788833086, "transport": "t", "ja3_hash": "2c1ae05fc8206445f09455084842b31a", "ja3_variant_count": 1, "ja3_variants": [ "2c1ae05fc8206445f09455084842b31a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511ht_8daaf6152771_eabd1bfc1118", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511ht", "b": "8daaf6152771", "c": "eabd1bfc1118", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-23-11-65037-13-5-43-16-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788861973, "last_seen": 1788861973, "transport": "t", "ja3_hash": "e9f04622adb92ff7d3a14c570506b9d1", "ja3_variant_count": 1, "ja3_variants": [ "e9f04622adb92ff7d3a14c570506b9d1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_04c66c06b0db", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "04c66c06b0db", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-5-65037-18-27-45-43-13-35-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789203216, "last_seen": 1789203216, "transport": "t", "ja3_hash": "80a98d061b1d765cafabb6c757b771d1", "ja3_variant_count": 1, "ja3_variants": [ "80a98d061b1d765cafabb6c757b771d1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_0522689629f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "0522689629f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-10-11-18-5-43-27-35-65281-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789058304, "last_seen": 1789058304, "transport": "t", "ja3_hash": "25eda0b30db017ca4631194f48d9a977", "ja3_variant_count": 1, "ja3_variants": [ "25eda0b30db017ca4631194f48d9a977" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_5f99475caf07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "5f99475caf07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-11-35-43-65281-23-65037-17613-13-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788963768, "last_seen": 1788963768, "transport": "t", "ja3_hash": "8037795f6c54945dc999c1b41142cde6", "ja3_variant_count": 1, "ja3_variants": [ "8037795f6c54945dc999c1b41142cde6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_921bcdcf95ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "921bcdcf95ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-27-17613-35-18-51764-11-43-5-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788743702, "last_seen": 1788743702, "transport": "t", "ja3_hash": "412de6fb0ab1ba3dee5ce8884e9fe9d4", "ja3_variant_count": 1, "ja3_variants": [ "412de6fb0ab1ba3dee5ce8884e9fe9d4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_95f5ee969d4f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "95f5ee969d4f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-65281-45-43-17613-10-35-11-13-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788926735, "last_seen": 1788926735, "transport": "t", "ja3_hash": "102436449776dc556a1004a73ea240ae", "ja3_variant_count": 1, "ja3_variants": [ "102436449776dc556a1004a73ea240ae" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_0b62351ed59b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "0b62351ed59b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-45-13-16-17613-43-65281-27-11-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789693038, "last_seen": 1789701362, "transport": "t", "ja3_hash": "9972e6e9cb21b525da6fa2b9d6c01687", "ja3_variant_count": 2, "ja3_variants": [ "9972e6e9cb21b525da6fa2b9d6c01687", "9426d9b5115d7393eaee1beca6d7e25b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_25dc63a7d079", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "25dc63a7d079", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-18-65037-65281-10-27-5-45-35-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789559402, "last_seen": 1789559402, "transport": "t", "ja3_hash": "e3902cb7ababd1b1a5c8b80093789bd9", "ja3_variant_count": 1, "ja3_variants": [ "e3902cb7ababd1b1a5c8b80093789bd9" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_2880e46a471e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "2880e46a471e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-17613-35-23-16-13-11-43-45-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789697938, "last_seen": 1789697938, "transport": "t", "ja3_hash": "fca6724fa60ee0712acb3d474ef22087", "ja3_variant_count": 1, "ja3_variants": [ "fca6724fa60ee0712acb3d474ef22087" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_314dec87a6f6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "314dec87a6f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-13-17613-11-43-18-45-35-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789173510, "last_seen": 1789730673, "transport": "t", "ja3_hash": "01dd0a9b8ae8ef573f7e924afa20572c", "ja3_variant_count": 2, "ja3_variants": [ "01dd0a9b8ae8ef573f7e924afa20572c", "51b0d4958c80aca03866d74c456ebe62" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_40744b62e667", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "40744b62e667", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-51764-13-10-45-23-35-17613-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789136980, "last_seen": 1789136980, "transport": "t", "ja3_hash": "aef11ba2fb5fcb061069aba6bc06b658", "ja3_variant_count": 1, "ja3_variants": [ "aef11ba2fb5fcb061069aba6bc06b658" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_42db30e1d14a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "42db30e1d14a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-5-65037-43-16-11-23-18-17613-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788612146, "last_seen": 1788612146, "transport": "t", "ja3_hash": "5ba5c79a76e86ae9d9790e3a5039a331", "ja3_variant_count": 1, "ja3_variants": [ "5ba5c79a76e86ae9d9790e3a5039a331" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_5dd90af9e70d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "5dd90af9e70d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-35-65281-18-13-43-45-5-16-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789699094, "last_seen": 1789699094, "transport": "t", "ja3_hash": "a7358bc94fbd446f0ee4d01dbba00161", "ja3_variant_count": 1, "ja3_variants": [ "a7358bc94fbd446f0ee4d01dbba00161" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_72b15e5a8388", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "72b15e5a8388", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-10-16-5-17613-43-65037-23-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789867026, "last_seen": 1789867026, "transport": "t", "ja3_hash": "f1a3cb43c0935735a86a889a52b09863", "ja3_variant_count": 1, "ja3_variants": [ "f1a3cb43c0935735a86a889a52b09863" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 36 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_8ae1788f8f1a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "8ae1788f8f1a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-27-10-11-43-17613-13-65281-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789683445, "last_seen": 1789683445, "transport": "t", "ja3_hash": "7c31fd789cebcdc9b3c0446772e8cd8e", "ja3_variant_count": 1, "ja3_variants": [ "7c31fd789cebcdc9b3c0446772e8cd8e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_8c561e63a674", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "8c561e63a674", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-10-18-23-65037-16-13-27-43-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789641615, "last_seen": 1789641615, "transport": "t", "ja3_hash": "b27a2e0b995c234a996974a4a0bdc075", "ja3_variant_count": 1, "ja3_variants": [ "b27a2e0b995c234a996974a4a0bdc075" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_a27a472bf3f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "a27a472bf3f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-17613-27-5-35-23-43-16-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788784126, "last_seen": 1788784126, "transport": "t", "ja3_hash": "0a317674085cecdc1455e4ee0c83e0a4", "ja3_variant_count": 1, "ja3_variants": [ "0a317674085cecdc1455e4ee0c83e0a4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_a3cbdcd74018", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "a3cbdcd74018", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-17613-5-23-27-13-43-18-65281-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788713161, "last_seen": 1788713161, "transport": "t", "ja3_hash": "3402bcaa401c6c293e693594d1dce6cd", "ja3_variant_count": 1, "ja3_variants": [ "3402bcaa401c6c293e693594d1dce6cd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_afe15e8fe743", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "afe15e8fe743", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-16-5-27-10-35-43-17613-18-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788947636, "last_seen": 1788947636, "transport": "t", "ja3_hash": "a657c2eaffd8a52d641581474ae78524", "ja3_variant_count": 1, "ja3_variants": [ "a657c2eaffd8a52d641581474ae78524" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_b44896b5765c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "b44896b5765c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-16-13-45-23-17613-5-11-10-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789010716, "last_seen": 1789010716, "transport": "t", "ja3_hash": "52dfcb80c6d9bf316fe164a6670ebfe8", "ja3_variant_count": 1, "ja3_variants": [ "52dfcb80c6d9bf316fe164a6670ebfe8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_bdaf653a0990", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "bdaf653a0990", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-43-17613-65037-65281-45-16-11-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788857374, "last_seen": 1788857374, "transport": "t", "ja3_hash": "1a32ee80b2e2bd2d859adb3138e4879d", "ja3_variant_count": 1, "ja3_variants": [ "1a32ee80b2e2bd2d859adb3138e4879d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_c1357a6d7902", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "c1357a6d7902", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-16-65281-13-10-5-17613-35-43-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788768519, "last_seen": 1788768519, "transport": "t", "ja3_hash": "7a7ea94efb2b4be148e8f6a798cde15c", "ja3_variant_count": 1, "ja3_variants": [ "7a7ea94efb2b4be148e8f6a798cde15c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_d3d06c1a2b11", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "d3d06c1a2b11", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-13-35-27-45-10-17613-43-18-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789656817, "last_seen": 1789656817, "transport": "t", "ja3_hash": "c78545db910e482d7a5f0e45c4091186", "ja3_variant_count": 1, "ja3_variants": [ "c78545db910e482d7a5f0e45c4091186" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_f30706a24caf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "f30706a24caf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-17613-11-27-45-13-5-23-18-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789913535, "last_seen": 1789913535, "transport": "t", "ja3_hash": "9b28ae5c1cd18910f24f82fea081b396", "ja3_variant_count": 1, "ja3_variants": [ "9b28ae5c1cd18910f24f82fea081b396" ], "user_agents": { "Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)": 4 }, "ua_disagreement": false } }, { "hash": "t13i1512ht_8daaf6152771_7c8aeee83bd0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512ht", "b": "8daaf6152771", "c": "7c8aeee83bd0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-16-43-13-5-65037-18-10-23-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789883142, "last_seen": 1789883142, "transport": "t", "ja3_hash": "a88f3f5d5a5946b6a2febb8e83d6a3e7", "ja3_variant_count": 1, "ja3_variants": [ "a88f3f5d5a5946b6a2febb8e83d6a3e7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512ht_8daaf6152771_93391c9647af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512ht", "b": "8daaf6152771", "c": "93391c9647af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-5-45-43-65281-65037-16-10-35-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789454641, "last_seen": 1789454641, "transport": "t", "ja3_hash": "639d93adb2938c9e171aa947510ce50c", "ja3_variant_count": 1, "ja3_variants": [ "639d93adb2938c9e171aa947510ce50c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512ht_8daaf6152771_f3f3d965e2d6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512ht", "b": "8daaf6152771", "c": "f3f3d965e2d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-23-43-13-65037-10-45-27-35-18-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789880479, "last_seen": 1789880479, "transport": "t", "ja3_hash": "a81c8f7b7c81c07bd381e504046c3045", "ja3_variant_count": 1, "ja3_variants": [ "a81c8f7b7c81c07bd381e504046c3045" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_0a20fe35d3a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "0a20fe35d3a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-5-45-10-11-65037-43-65281-35-23-13-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789630973, "last_seen": 1789880105, "transport": "t", "ja3_hash": "bae9c5775d5d8517d7b42ee09c6cfc04", "ja3_variant_count": 2, "ja3_variants": [ "bae9c5775d5d8517d7b42ee09c6cfc04", "d1b2298520e40bcef72842a986ec276e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_31ec0a762479", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "31ec0a762479", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-10-45-17613-65281-11-43-13-23-18-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788778657, "last_seen": 1788778657, "transport": "t", "ja3_hash": "40217d2213567f6fcfa6b3910dff8a82", "ja3_variant_count": 1, "ja3_variants": [ "40217d2213567f6fcfa6b3910dff8a82" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_5c900899d641", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "5c900899d641", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-17613-43-5-23-10-11-65037-27-35-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788767903, "last_seen": 1788767903, "transport": "t", "ja3_hash": "9f4cc5c361e53f94a32542082066b8ed", "ja3_variant_count": 1, "ja3_variants": [ "9f4cc5c361e53f94a32542082066b8ed" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_bb32da23ee32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "bb32da23ee32", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-27-43-35-65037-18-11-45-17613-13-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789638667, "last_seen": 1789638667, "transport": "t", "ja3_hash": "d1f0df7111ee1867a59031f706eefb4e", "ja3_variant_count": 1, "ja3_variants": [ "d1f0df7111ee1867a59031f706eefb4e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_e62bcbb35888", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "e62bcbb35888", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-65037-23-43-45-17613-18-5-65281-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789638547, "last_seen": 1789638547, "transport": "t", "ja3_hash": "56cb0bf8f1e57753c6679413b0f9f1b8", "ja3_variant_count": 1, "ja3_variants": [ "56cb0bf8f1e57753c6679413b0f9f1b8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_f8ed8b5d7f00", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "f8ed8b5d7f00", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-43-17613-65281-65037-11-35-23-45-13-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788793840, "last_seen": 1788793840, "transport": "t", "ja3_hash": "1095e9813dce465e1727727a9bf2e44a", "ja3_variant_count": 1, "ja3_variants": [ "1095e9813dce465e1727727a9bf2e44a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_0ed862f43755", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "0ed862f43755", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-23-65037-43-11-16-45-17613-13-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788915440, "last_seen": 1788915440, "transport": "t", "ja3_hash": "825037495ce13d46bbbba06bdcd5c528", "ja3_variant_count": 1, "ja3_variants": [ "825037495ce13d46bbbba06bdcd5c528" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_2d6c3a04e7f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "2d6c3a04e7f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51764-17613-5-23-11-16-43-13-18-65037-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508426, "last_seen": 1788508426, "transport": "t", "ja3_hash": "d35b763d94d8a77bedc31c0044f1d304", "ja3_variant_count": 1, "ja3_variants": [ "d35b763d94d8a77bedc31c0044f1d304" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_2e4a1eb1cf75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "2e4a1eb1cf75", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-51764-10-13-17613-11-27-45-43-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723977, "last_seen": 1788723977, "transport": "t", "ja3_hash": "4fdfd871f1e96e9ec0c75186d879a025", "ja3_variant_count": 1, "ja3_variants": [ "4fdfd871f1e96e9ec0c75186d879a025" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_3372136e8f74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "3372136e8f74", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-65281-23-35-16-11-13-17613-27-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788771927, "last_seen": 1788771927, "transport": "t", "ja3_hash": "ca159706ebf529dac6dd86295c89de5a", "ja3_variant_count": 1, "ja3_variants": [ "ca159706ebf529dac6dd86295c89de5a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_34d57375c2af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "34d57375c2af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-35-17613-65037-43-27-13-5-23-45-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789023432, "last_seen": 1789023432, "transport": "t", "ja3_hash": "f3b4fb2ce421cc71374fe2741f4632a1", "ja3_variant_count": 1, "ja3_variants": [ "f3b4fb2ce421cc71374fe2741f4632a1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_3ee1b7216851", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "3ee1b7216851", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-11-16-18-43-5-10-65037-65281-13-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789740596, "last_seen": 1789740596, "transport": "t", "ja3_hash": "1688abd439c7f824d43a5bfe4a0ae1a8", "ja3_variant_count": 1, "ja3_variants": [ "1688abd439c7f824d43a5bfe4a0ae1a8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_55f8212217b0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "55f8212217b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-11-35-45-65037-65281-23-18-16-5-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789889313, "last_seen": 1789889313, "transport": "t", "ja3_hash": "47fd86c8fd0d17856381dc4934dc13b6", "ja3_variant_count": 1, "ja3_variants": [ "47fd86c8fd0d17856381dc4934dc13b6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_5ba53e51277a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "5ba53e51277a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-65037-27-65281-45-10-16-18-35-17613-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788794438, "last_seen": 1788794438, "transport": "t", "ja3_hash": "ed8f136e0b4d7d8ab5c5f19789246f1e", "ja3_variant_count": 1, "ja3_variants": [ "ed8f136e0b4d7d8ab5c5f19789246f1e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_669ff8a3d9ac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "669ff8a3d9ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-45-23-43-16-11-10-65037-18-27-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788643329, "last_seen": 1788643329, "transport": "t", "ja3_hash": "5f7c3b8e8b58fece3c021921d267f31c", "ja3_variant_count": 1, "ja3_variants": [ "5f7c3b8e8b58fece3c021921d267f31c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_7dc829385eb9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "7dc829385eb9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-23-45-35-18-13-43-27-10-5-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789909240, "last_seen": 1789909240, "transport": "t", "ja3_hash": "14141bbf9ab14f1d6bfde2f6a8f9141e", "ja3_variant_count": 1, "ja3_variants": [ "14141bbf9ab14f1d6bfde2f6a8f9141e" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_88efbe479c48", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "88efbe479c48", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-5-10-27-18-45-65281-16-13-17613-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789688743, "last_seen": 1789688743, "transport": "t", "ja3_hash": "9c5f5c020c88a1208a8d18fd4530af53", "ja3_variant_count": 1, "ja3_variants": [ "9c5f5c020c88a1208a8d18fd4530af53" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_9e2d1ce52865", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "9e2d1ce52865", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-18-45-35-16-23-17613-11-65037-27-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730751, "last_seen": 1789730751, "transport": "t", "ja3_hash": "344239cac435829da596bba3a2df96a4", "ja3_variant_count": 1, "ja3_variants": [ "344239cac435829da596bba3a2df96a4" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/133.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_afb0d6126337", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "afb0d6126337", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-35-5-11-13-18-43-65037-27-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789415764, "last_seen": 1789415764, "transport": "t", "ja3_hash": "7808acbb987e937858a80a2209720774", "ja3_variant_count": 1, "ja3_variants": [ "7808acbb987e937858a80a2209720774" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_b94ac9c5b0ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "b94ac9c5b0ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-43-17613-13-27-5-23-18-45-35-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789685771, "last_seen": 1789685771, "transport": "t", "ja3_hash": "062f641f254cf4fd90e32d71e3ee7c75", "ja3_variant_count": 1, "ja3_variants": [ "062f641f254cf4fd90e32d71e3ee7c75" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_d38ba523880f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "d38ba523880f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-35-10-65037-65281-18-27-23-16-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789656770, "last_seen": 1789656770, "transport": "t", "ja3_hash": "793f6059e400085bf6bca3fce6adcb81", "ja3_variant_count": 1, "ja3_variants": [ "793f6059e400085bf6bca3fce6adcb81" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_e8aea5e497cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "e8aea5e497cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-11-35-17613-65281-13-27-65037-5-45-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789690410, "last_seen": 1789690410, "transport": "t", "ja3_hash": "f8e16c5fe20089e943a8f7ee5939af43", "ja3_variant_count": 1, "ja3_variants": [ "f8e16c5fe20089e943a8f7ee5939af43" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_ed206f18ca9c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "ed206f18ca9c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-65037-27-13-16-17613-11-18-35-45-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789656699, "last_seen": 1789656699, "transport": "t", "ja3_hash": "e484e787735aace8d6ea599783dc4eeb", "ja3_variant_count": 1, "ja3_variants": [ "e484e787735aace8d6ea599783dc4eeb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_f43814a5f4ac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "f43814a5f4ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-18-16-45-5-43-35-13-17613-27-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789741401, "last_seen": 1789741401, "transport": "t", "ja3_hash": "52ee3b437e33c13c2455ec0993e2331f", "ja3_variant_count": 1, "ja3_variants": [ "52ee3b437e33c13c2455ec0993e2331f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i1513ht_8daaf6152771_7dc829385eb9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513ht", "b": "8daaf6152771", "c": "7dc829385eb9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-23-10-11-27-16-13-45-18-43-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788849247, "last_seen": 1789636870, "transport": "t", "ja3_hash": "64ec2e5a9ae59a1dbaf0e2b49ec7874a", "ja3_variant_count": 3, "ja3_variants": [ "64ec2e5a9ae59a1dbaf0e2b49ec7874a", "64df75105c0f387daecb505f189047ee", "d6bd85551f9276c9df8fed4251f947a6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151400_8daaf6152771_536ae4be68ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151400", "b": "8daaf6152771", "c": "536ae4be68ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-11-65281-18-13-51764-27-43-35-10-65037-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788776779, "last_seen": 1788776779, "transport": "t", "ja3_hash": "f7025790310a275446071146436ae85f", "ja3_variant_count": 1, "ja3_variants": [ "f7025790310a275446071146436ae85f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i151400_8daaf6152771_68a132d176ba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151400", "b": "8daaf6152771", "c": "68a132d176ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51764-27-65037-18-43-23-65281-17613-10-45-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811236, "last_seen": 1788811236, "transport": "t", "ja3_hash": "c18c892fcbd8bba406281dccbdd189c3", "ja3_variant_count": 1, "ja3_variants": [ "c18c892fcbd8bba406281dccbdd189c3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13i151400_8daaf6152771_a020cb67ec98", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151400", "b": "8daaf6152771", "c": "a020cb67ec98", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-27-11-35-51764-65281-13-10-45-5-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789749893, "last_seen": 1789749893, "transport": "t", "ja3_hash": "942551ec557d79cda22ff7e631edca43", "ja3_variant_count": 1, "ja3_variants": [ "942551ec557d79cda22ff7e631edca43" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i151400_8daaf6152771_d8a2da3f94cd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151400", "b": "8daaf6152771", "c": "d8a2da3f94cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-35-23-11-65037-43-13-65281-17613-27-45-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789023260, "last_seen": 1789920887, "transport": "t", "ja3_hash": "8d3ad82e856538daf09de1a8b5466b67", "ja3_variant_count": 2, "ja3_variants": [ "8d3ad82e856538daf09de1a8b5466b67", "cc4f5f44f9ed5b795cd99f70f7189f84" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_096c65dec9c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "096c65dec9c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-65281-13-43-17613-10-5-23-27-45-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789769187, "last_seen": 1789769187, "transport": "t", "ja3_hash": "61a21c1ad13bbb7ed7ad1ee6a5644213", "ja3_variant_count": 1, "ja3_variants": [ "61a21c1ad13bbb7ed7ad1ee6a5644213" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_0ed4dee2b837", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "0ed4dee2b837", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-43-27-11-65037-45-18-13-17613-35-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789693006, "last_seen": 1789693006, "transport": "t", "ja3_hash": "152a1f5bfbe45ec24a7a4fc42160f9db", "ja3_variant_count": 1, "ja3_variants": [ "152a1f5bfbe45ec24a7a4fc42160f9db" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_153e41bb36c4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "153e41bb36c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-10-27-13-5-43-18-65281-11-35-16-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789262286, "last_seen": 1789262286, "transport": "t", "ja3_hash": "c583c26f2e31875bcd0f2c869fac1eaa", "ja3_variant_count": 1, "ja3_variants": [ "c583c26f2e31875bcd0f2c869fac1eaa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_3ffa1e88bf3d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "3ffa1e88bf3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-43-11-35-65037-5-17613-45-18-23-65281-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789849791, "last_seen": 1789849791, "transport": "t", "ja3_hash": "58d6dc6a3506bf7f9a31877a42c3d5e8", "ja3_variant_count": 1, "ja3_variants": [ "58d6dc6a3506bf7f9a31877a42c3d5e8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_46b71f6274ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "46b71f6274ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-65281-27-18-16-23-13-35-11-65037-43-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788643121, "last_seen": 1789217892, "transport": "t", "ja3_hash": "d23741a21a0ceaf826c5280e7bf1e69a", "ja3_variant_count": 2, "ja3_variants": [ "d23741a21a0ceaf826c5280e7bf1e69a", "68e5b9f401c5f26010aa9b4ac975adf4" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 8 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_5cd5205d8de2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "5cd5205d8de2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-65037-45-10-43-27-17613-5-11-16-65281-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789482702, "last_seen": 1789730824, "transport": "t", "ja3_hash": "df91559e44c0d3de100f0a481af4d36b", "ja3_variant_count": 2, "ja3_variants": [ "df91559e44c0d3de100f0a481af4d36b", "1787c3e389625abcece7eb44cd26840c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_62f05041f2ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "62f05041f2ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 188, "first_seen": 1789217711, "last_seen": 1789967138, "transport": "t", "ja3_hash": "b592adaa596bb72a5c1ccdbecae52e3f", "ja3_variant_count": 1, "ja3_variants": [ "b592adaa596bb72a5c1ccdbecae52e3f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0": 7, "Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0": 5 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_856caef005a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "856caef005a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-18-65037-45-51764-13-10-17613-16-11-27-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789375386, "last_seen": 1789375386, "transport": "t", "ja3_hash": "62a7bb0da3d0d04437279d644af156e5", "ja3_variant_count": 1, "ja3_variants": [ "62a7bb0da3d0d04437279d644af156e5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_988075c57bf4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "988075c57bf4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-45-5-11-27-43-35-65037-18-17613-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788692691, "last_seen": 1789966964, "transport": "t", "ja3_hash": "1b7d5e7061c80e494dcd5f7842381f85", "ja3_variant_count": 3, "ja3_variants": [ "1b7d5e7061c80e494dcd5f7842381f85", "ff86adb285dcb7afb36fd32f8f062098", "34a4ad6f9b34de28f1f763c6ae70e55b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 8, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13i1514h2_8daaf6152771_a0e623ada22a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "a0e623ada22a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-51764-13-4832-16-11-35-27-10-5-65281-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788445305, "last_seen": 1788445305, "transport": "t", "ja3_hash": "0030145063d581c229f0a0ea11903d22", "ja3_variant_count": 1, "ja3_variants": [ "0030145063d581c229f0a0ea11903d22" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13i1514ht_8daaf6152771_46b71f6274ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514ht", "b": "8daaf6152771", "c": "46b71f6274ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-43-18-27-65281-16-23-13-65037-35-45-10-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788845969, "last_seen": 1788845969, "transport": "t", "ja3_hash": "e4547e880968ba37f4940e05dd78e4d7", "ja3_variant_count": 1, "ja3_variants": [ "e4547e880968ba37f4940e05dd78e4d7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_0aed32fb2910", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "0aed32fb2910", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17513-45-13-35-27-11-18-65281-51-43-65037-5-10-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788446839, "last_seen": 1789583909, "transport": "t", "ja3_hash": "3de7e3c15a8986c6ae8396906e950563", "ja3_variant_count": 10, "ja3_variants": [ "3de7e3c15a8986c6ae8396906e950563", "1d712d5aab13d9e1e7df273b9637fed0", "75baf5ddd502384a14758ef52e959792", "132f7293f9a1abd8c4ff0b5b87775616", "f85d07f1981343333d0a657332706ea0", "1c3b05ce4c80c726255e7dc71500c56a", "9575e991e4e6ae3e94d6969a379c0fd0", "85350cc2383b4d8bfddadba47c4588d8", "86689c14c9c85706defa32820dcfc156", "3237c297840f2ea27a7d76e4b8d44008" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_1c2f3143de88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "1c2f3143de88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-17613-43-13-45-35-65281-11-27-10-65037-51764-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788724240, "last_seen": 1788724240, "transport": "t", "ja3_hash": "f579fa4f35268650ff74b696ba2b1221", "ja3_variant_count": 1, "ja3_variants": [ "f579fa4f35268650ff74b696ba2b1221" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_d7f4947ee382", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "d7f4947ee382", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,43-11-23-51-16-10-18-27-5-13-17613-35-45-65281-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788648473, "last_seen": 1788934003, "transport": "t", "ja3_hash": "52e8b9c93795bb0f21a3c605c96098a1", "ja3_variant_count": 5, "ja3_variants": [ "52e8b9c93795bb0f21a3c605c96098a1", "1a8999d24d13cfb4ccfa77e5553325b0", "7c0edfffbd953fb7a89f9089bb4521ef", "660c59d117bf2c99846c981c0af5f06f", "532f44d2e9641673d1d33282c39dea58" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36": 4, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 3, "RootEvidence/1.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_fccf9dc7fe97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "fccf9dc7fe97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-17613-23-5-27-35-65281-43-18-10-65037-16-11-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 140, "first_seen": 1788681444, "last_seen": 1789967090, "transport": "t", "ja3_hash": "3cc744dfe982fca461dc4d1a55e5cc84", "ja3_variant_count": 140, "ja3_variants": [ "3cc744dfe982fca461dc4d1a55e5cc84", "e470d959d616e14dd188173856f4b293", "776b24710ff92c8d9ed603241a61d107", "ddcffc99751dfa8736f70604c278e094", "9e7483c39b38b2383ba9ac0fdd7a7b33", "b3d5520ad6aacd1a32fd09f795092178", "95656d0707955253ecd3122486b0f6c9", "ca5d8e80efe6cacca09b335f86dc7947", "35a87e8d1ec66a4c71214733f66033ff", "0afc7ed185a0847aa4cb64622f69815a", "f09c05cb6cd2aaa6623a77983ca59542", "54b61690874dc57245a464d2f1e859b5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 35, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Vivaldi/7.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 OPR/119.0.0.0": 2, "Mozilla/5.0 (compatible; ForestEngine/1.0; +https://forestengine.net/)": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/132.0.0.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 14; SM-G991B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/25.0 Chrome/121.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0": 8, "Mozilla/5.0 (Android 14; Mobile; rv:136.0) Gecko/136.0 Firefox/136.0": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 YaBrowser/25.1.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 YaBrowser/25.2.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 3, "Go-http-client/2.0": 3, "Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 OPR/119.0.0.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0": 1, "Mozilla/5.0 (Android 14; Mobile; rv:135.0) Gecko/135.0 Firefox/135.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Vivaldi/7.0": 1, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 1, "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13i1515ht_8daaf6152771_fccf9dc7fe97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515ht", "b": "8daaf6152771", "c": "fccf9dc7fe97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-10-45-17613-11-65281-16-51-27-5-35-18-23-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789364297, "last_seen": 1789824096, "transport": "t", "ja3_hash": "7efffcde32f52af45afac548c2184628", "ja3_variant_count": 2, "ja3_variants": [ "7efffcde32f52af45afac548c2184628", "1a71878b5c1fe646b0fc7dc9cb9453fd" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1711ht_ab0a1bf427ad_703f33515997", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1711ht", "b": "ab0a1bf427ad", "c": "703f33515997", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-11-10-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788124847, "last_seen": 1789889292, "transport": "t", "ja3_hash": "fb0c9cea0478d6132076f4cdcb0d5224", "ja3_variant_count": 1, "ja3_variants": [ "fb0c9cea0478d6132076f4cdcb0d5224" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i1713h2_5b57614c22b0_9f4fbefdc738", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1713h2", "b": "5b57614c22b0", "c": "9f4fbefdc738", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,28-10-13-43-18-23-27-5-11-65281-65037-16-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 28, "name": "record_size_limit", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789750277, "last_seen": 1789750277, "transport": "t", "ja3_hash": "20ab773c17dff4086ad357f238a728bb", "ja3_variant_count": 1, "ja3_variants": [ "20ab773c17dff4086ad357f238a728bb" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3619.132 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1714h2_5b57614c22b0_d27576f0e476", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1714h2", "b": "5b57614c22b0", "c": "d27576f0e476", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,23-65281-10-11-35-16-5-34-51-43-13-45-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 226, "first_seen": 1787466554, "last_seen": 1789967134, "transport": "t", "ja3_hash": "a4a7efb11da858ab9c34dc7fbb241bcb", "ja3_variant_count": 1, "ja3_variants": [ "a4a7efb11da858ab9c34dc7fbb241bcb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 8 }, "ua_disagreement": false } }, { "hash": "t13i180900_e8a523a41297_78e6aca7449b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i180900", "b": "e8a523a41297", "c": "78e6aca7449b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4867-4865-4866-49199-49195-49200-49196-52393-52392-49161-49171-49162-49172-156-157-47-53-10,23-65281-10-11-35-13-51-45-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 19, "first_seen": 1787573181, "last_seen": 1789837184, "transport": "t", "ja3_hash": "43cf532976cbdec73c21b564756fd088", "ja3_variant_count": 1, "ja3_variants": [ "43cf532976cbdec73c21b564756fd088" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203": 19 }, "ua_disagreement": false } }, { "hash": "t13i181000_85036bcba153_d41ae481755e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i181000", "b": "85036bcba153", "c": "d41ae481755e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 64, "first_seen": 1787490595, "last_seen": 1789665546, "transport": "t", "ja3_hash": "8a9d5d0f12f7d43ee3af1c51d2998d99", "ja3_variant_count": 1, "ja3_variants": [ "8a9d5d0f12f7d43ee3af1c51d2998d99" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0": 3, "Mozilla/5.0": 7 }, "ua_disagreement": false } }, { "hash": "t13i1810ht_e8a523a41297_da06f2e414f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (da06f2e414f4) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13i1810ht", "b": "e8a523a41297", "c": "da06f2e414f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-10-4865-4866-4867,5-10-11-13-65281-23-16-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789565708, "last_seen": 1789565708, "transport": "t", "ja3_hash": "4b5262fbeaaa013d0f561ff2b8fccfa6", "ja3_variant_count": 1, "ja3_variants": [ "4b5262fbeaaa013d0f561ff2b8fccfa6" ], "user_agents": { "Mozilla/5.0 (compatible; simplehelp-scan/1.0)": 1 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13i181100_e8a523a41297_02c8e53ee398", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i181100", "b": "e8a523a41297", "c": "02c8e53ee398", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4867-4865-4866-49199-49195-49200-49196-52393-52392-49161-49171-49162-49172-156-157-47-53-10,23-65281-10-11-35-13-51-45-43-21-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787980413, "last_seen": 1789837188, "transport": "t", "ja3_hash": "7c5a42bc3e6679b3cdf9ae958f3a6f4f", "ja3_variant_count": 1, "ja3_variants": [ "7c5a42bc3e6679b3cdf9ae958f3a6f4f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203": 8 }, "ua_disagreement": false } }, { "hash": "t13i1811ht_85036bcba153_a3954c448de3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1811ht", "b": "85036bcba153", "c": "a3954c448de3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 27, "first_seen": 1787444928, "last_seen": 1789964043, "transport": "t", "ja3_hash": "b0020a04d796a92096d3928b119a51f6", "ja3_variant_count": 1, "ja3_variants": [ "b0020a04d796a92096d3928b119a51f6" ], "user_agents": { "Python/3.13 aiohttp/3.13.3": 2, "python-httpx/0.28.1": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 6 }, "ua_disagreement": true } }, { "hash": "t13i1909h2_9dc949149365_c6544fb8b0b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1909h2", "b": "9dc949149365", "c": "c6544fb8b0b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 557, "first_seen": 1787450013, "last_seen": 1789966780, "transport": "t", "ja3_hash": "7c1e207beb00684bbbe144f1b0abe1d5", "ja3_variant_count": 3, "ja3_variants": [ "7c1e207beb00684bbbe144f1b0abe1d5", "5af43e5eee17271a9eb37dce2ab407a8", "3590d1b8f63dd1d590f0adea4227443d" ], "user_agents": { "visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36": 66, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3": 55, "Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)": 67, "grpcurl/dev-build (no version set) grpc-go/1.48.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 15 }, "ua_disagreement": true } }, { "hash": "t13i1909ht_9dc949149365_c6544fb8b0b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1909ht", "b": "9dc949149365", "c": "c6544fb8b0b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788293171, "last_seen": 1789261988, "transport": "t", "ja3_hash": "a3710a0cb04a8c61bb7ed96e70103f1e", "ja3_variant_count": 1, "ja3_variants": [ "a3710a0cb04a8c61bb7ed96e70103f1e" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i191000_9dc949149365_be53661681a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i191000", "b": "9dc949149365", "c": "be53661681a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 10, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-35-13-65281-18-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787537715, "last_seen": 1789540926, "transport": "t", "ja3_hash": "f7e86b32bc0db5b6a594afac7cfc570c", "ja3_variant_count": 1, "ja3_variants": [ "f7e86b32bc0db5b6a594afac7cfc570c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i1910h2_9dc949149365_da06f2e414f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1910h2", "b": "9dc949149365", "c": "da06f2e414f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 19, "first_seen": 1787691404, "last_seen": 1789041462, "transport": "t", "ja3_hash": "c817aa2c11bd73320f909678c095d63f", "ja3_variant_count": 1, "ja3_variants": [ "c817aa2c11bd73320f909678c095d63f" ], "user_agents": { "rawgrab": 8, "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1911ht_9dc949149365_536e8a1380cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1911ht", "b": "9dc949149365", "c": "536e8a1380cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-50-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1789154750, "last_seen": 1789815050, "transport": "t", "ja3_hash": "cadc9fa1fb68c3ba6ecca8c1cc913cd5", "ja3_variant_count": 1, "ja3_variants": [ "cadc9fa1fb68c3ba6ecca8c1cc913cd5" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36": 2, "rawgrab": 8 }, "ua_disagreement": false } }, { "hash": "t13i200900_2b729b4bf6f3_29829a46703f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i200900", "b": "2b729b4bf6f3", "c": "29829a46703f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,43-13-35-10-51-49-23-65281-45,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789141349, "last_seen": 1789141349, "transport": "t", "ja3_hash": "4d5efa96609dc906f796e63cff009c2a", "ja3_variant_count": 1, "ja3_variants": [ "4d5efa96609dc906f796e63cff009c2a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i201000_2b729b4bf6f3_36bf25f296df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i201000", "b": "2b729b4bf6f3", "c": "36bf25f296df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,43-13-35-10-11-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789132953, "last_seen": 1789352697, "transport": "t", "ja3_hash": "97fdf2ec3a65cf52e01241699b677063", "ja3_variant_count": 1, "ja3_variants": [ "97fdf2ec3a65cf52e01241699b677063" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i201100_2b729b4bf6f3_e24568c0d440", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i201100", "b": "2b729b4bf6f3", "c": "e24568c0d440", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,5-43-13-35-10-11-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789895179, "last_seen": 1789895179, "transport": "t", "ja3_hash": "584900de6273bb0e673db58cc107a882", "ja3_variant_count": 1, "ja3_variants": [ "584900de6273bb0e673db58cc107a882" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i201200_a09f3c656075_4174f7a35093", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i201200", "b": "a09f3c656075", "c": "4174f7a35093", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,65281-11-10-35-5-22-18-23-13-43-45-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789506234, "last_seen": 1789525781, "transport": "t", "ja3_hash": "09c22e00e519d501d237368a0ede51e6", "ja3_variant_count": 1, "ja3_variants": [ "09c22e00e519d501d237368a0ede51e6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko)": 11, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/27.0 Safari/605.1.15": 7 }, "ua_disagreement": false } }, { "hash": "t13i2013h2_a09f3c656075_d86fb8de1683", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i2013h2", "b": "a09f3c656075", "c": "d86fb8de1683", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 179, "first_seen": 1789056443, "last_seen": 1789967142, "transport": "t", "ja3_hash": "5a527c775ff4ae29b4f0c77b113f9625", "ja3_variant_count": 1, "ja3_variants": [ "5a527c775ff4ae29b4f0c77b113f9625" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1": 23, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i2412ht_df98b6d6dfe4_6073e0ac6c48", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i2412ht", "b": "df98b6d6dfe4", "c": "6073e0ac6c48", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 24, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-52393-52392-49195-49199-49188-49192-49187-49191-49162-49172-49161-49171-157-156-61-60-53-47-255,11-10-13172-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788826669, "last_seen": 1789311975, "transport": "t", "ja3_hash": "410d9b65ff73443a9a062d12534d1ea7", "ja3_variant_count": 1, "ja3_variants": [ "410d9b65ff73443a9a062d12534d1ea7" ], "user_agents": { "Openwave/ UCWEB7.0.2.37/28/999": 2, "Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11": 2, "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16": 2 }, "ua_disagreement": false } }, { "hash": "t13i250800_b78ed14e2fd0_97f8aa674fd9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i250800", "b": "b78ed14e2fd0", "c": "97f8aa674fd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49161-49187-49195-49162-49196-52393-49159-49170-49171-49191-49199-49172-49200-52392-49169-10-47-60-156-53-157-5-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 105, "first_seen": 1787469624, "last_seen": 1789965747, "transport": "t", "ja3_hash": "3ec6556e7c9ab2a2381d8f9e742b0779", "ja3_variant_count": 2, "ja3_variants": [ "3ec6556e7c9ab2a2381d8f9e742b0779", "b5f98d2b3acc6f53bb534d6746c1da1b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0": 1, "Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 OPR/120.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i250900_b78ed14e2fd0_e7c285222651", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i250900", "b": "b78ed14e2fd0", "c": "e7c285222651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,11-65281-23-18-5-10-13-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 71, "first_seen": 1787508003, "last_seen": 1789824835, "transport": "t", "ja3_hash": "9b72665518dedb3531426284fdec8237", "ja3_variant_count": 2, "ja3_variants": [ "9b72665518dedb3531426284fdec8237", "abca373cc3696cd1d9e3f855310e2cb7" ], "user_agents": { "Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15": 2 }, "ua_disagreement": false } }, { "hash": "t13i251000_b78ed14e2fd0_ab7e3b40a677", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i251000", "b": "b78ed14e2fd0", "c": "ab7e3b40a677", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 309, "first_seen": 1787444559, "last_seen": 1789871654, "transport": "t", "ja3_hash": "11a384388ad36777e1a2e121495037fe", "ja3_variant_count": 3, "ja3_variants": [ "11a384388ad36777e1a2e121495037fe", "416eca07dcaad72dec6f76d1277b3eff", "0698e491fd3a749dfdb6160baf27df93" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0": 2, "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.7": 2, "Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 2, "RootEvidence/1.0": 190, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Safari/605.1.15": 1, "Mozilla/5.0 (Windows; U; Windows NT 6.1; ko-KR) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27": 1 }, "ua_disagreement": false } }, { "hash": "t13i2510h2_b78ed14e2fd0_da06f2e414f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (da06f2e414f4) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13i2510h2", "b": "b78ed14e2fd0", "c": "da06f2e414f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,11-65281-23-18-5-10-13-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788030315, "last_seen": 1789412042, "transport": "t", "ja3_hash": "7bbe85ef3812bcf372fa8fa77ceb4393", "ja3_variant_count": 1, "ja3_variants": [ "7bbe85ef3812bcf372fa8fa77ceb4393" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 6 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13i2511h2_b78ed14e2fd0_d86ca3cca451", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i2511h2", "b": "b78ed14e2fd0", "c": "d86ca3cca451", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,11-65281-23-18-5-10-13-50-16-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 79, "first_seen": 1787647316, "last_seen": 1789703415, "transport": "t", "ja3_hash": "f20f35624b79af10f537cb4e1e40197e", "ja3_variant_count": 1, "ja3_variants": [ "f20f35624b79af10f537cb4e1e40197e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36": 79 }, "ua_disagreement": false } }, { "hash": "t13i2512h2_b78ed14e2fd0_ea59f70d4047", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i2512h2", "b": "b78ed14e2fd0", "c": "ea59f70d4047", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,11-35-65281-23-18-5-10-13-16-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788030318, "last_seen": 1789412044, "transport": "t", "ja3_hash": "0d1427d71ce75d196bcc08bde920c292", "ja3_variant_count": 1, "ja3_variants": [ "0d1427d71ce75d196bcc08bde920c292" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i300900_1d37bd780c83_3550537cd59b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i300900", "b": "1d37bd780c83", "c": "3550537cd59b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-22-23-13-43-45-51,4588-4587-4590-29-23-30-24-25-41-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4590, "name": "4590 (0x11ee)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788215508, "last_seen": 1789100238, "transport": "t", "ja3_hash": "4069ade96b9940f32cc037958922862e", "ja3_variant_count": 1, "ja3_variants": [ "4069ade96b9940f32cc037958922862e" ], "user_agents": { "Scrapy/2.17.0 (+https://scrapy.org)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i301000_1d37bd780c83_0d46a1bf4a7c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i301000", "b": "1d37bd780c83", "c": "0d46a1bf4a7c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-35-22-23-13-43-45-51,4588-4587-4590-29-23-30-24-25-41-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4590, "name": "4590 (0x11ee)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787807789, "last_seen": 1789268705, "transport": "t", "ja3_hash": "4673db83e469a509574553048f28e263", "ja3_variant_count": 1, "ja3_variants": [ "4673db83e469a509574553048f28e263" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i3012h2_1d37bd780c83_cde28b4b7b1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3012h2", "b": "1d37bd780c83", "c": "cde28b4b7b1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 8572, "first_seen": 1787443307, "last_seen": 1789966906, "transport": "t", "ja3_hash": "7587a1ac9a4f17b4e4e5fe226716f4df", "ja3_variant_count": 1, "ja3_variants": [ "7587a1ac9a4f17b4e4e5fe226716f4df" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i311000_e8f1e7e78f70_5635d0cdb6df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i311000", "b": "e8f1e7e78f70", "c": "5635d0cdb6df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-158-49188-49192-49187-49191-107-103-49162-49172-49161-49171-57-51-157-156-61-60-53-47-255,5-10-11-13-50-17-23-43-45-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789703335, "last_seen": 1789703335, "transport": "t", "ja3_hash": "99ba718ac6cddc05d4f82b34c18b06b6", "ja3_variant_count": 1, "ja3_variants": [ "99ba718ac6cddc05d4f82b34c18b06b6" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i311000_e8f1e7e78f70_d41ae481755e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i311000", "b": "e8f1e7e78f70", "c": "d41ae481755e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 178, "first_seen": 1787472033, "last_seen": 1789892620, "transport": "t", "ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d", "ja3_variant_count": 2, "ja3_variants": [ "c12b4ccd5320bbb380ca1a9df90f771d", "004556e859f3c26c5d19746b3a957c74" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36": 1, "Mozilla/5.0": 58, "ExposureScanner/1.0 (internal-security-audit)": 15, "Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)": 7 }, "ua_disagreement": false } }, { "hash": "t13i311100_e8f1e7e78f70_ccd0985badbe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i311100", "b": "e8f1e7e78f70", "c": "ccd0985badbe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 24, "first_seen": 1787457273, "last_seen": 1789620299, "transport": "t", "ja3_hash": "cd350275e54f0c0d6df9f3c93af0211d", "ja3_variant_count": 1, "ja3_variants": [ "cd350275e54f0c0d6df9f3c93af0211d" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0": 23 }, "ua_disagreement": false } }, { "hash": "t13i3111ht_e8f1e7e78f70_aaee209e3cc1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3111ht", "b": "e8f1e7e78f70", "c": "aaee209e3cc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787722750, "last_seen": 1789586255, "transport": "t", "ja3_hash": "9b55a9609c756df436b6aa0a2adee99e", "ja3_variant_count": 1, "ja3_variants": [ "9b55a9609c756df436b6aa0a2adee99e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 4, "CVE-2023-20198": 2 }, "ua_disagreement": false } }, { "hash": "t13i3112ht_e8f1e7e78f70_6073e0ac6c48", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3112ht", "b": "e8f1e7e78f70", "c": "6073e0ac6c48", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-13172-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788826666, "last_seen": 1789310339, "transport": "t", "ja3_hash": "0d85f6adde9dc6aa98804d6cfa2f90c1", "ja3_variant_count": 1, "ja3_variants": [ "0d85f6adde9dc6aa98804d6cfa2f90c1" ], "user_agents": { "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0;": 1, "Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i3112ht_e8f1e7e78f70_e318ab2321b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3112ht", "b": "e8f1e7e78f70", "c": "e318ab2321b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 208, "first_seen": 1787647537, "last_seen": 1789703553, "transport": "t", "ja3_hash": "48eb9b1182293f55c0710654b7b12fc6", "ja3_variant_count": 1, "ja3_variants": [ "48eb9b1182293f55c0710654b7b12fc6" ], "user_agents": { "python-urllib3/2.7.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36": 211 }, "ua_disagreement": false } }, { "hash": "t13i351200_bfa337485184_990ad2f8d693", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i351200", "b": "bfa337485184", "c": "990ad2f8d693", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 35, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-11-10-35-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787468080, "last_seen": 1789469631, "transport": "t", "ja3_hash": "afebc28e206410651a1ae4c4c0d39046", "ja3_variant_count": 1, "ja3_variants": [ "afebc28e206410651a1ae4c4c0d39046" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36": 1, "Mozilla/5.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i3612ht_bcee18a5b459_d77d5b6d2047", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3612ht", "b": "bcee18a5b459", "c": "d77d5b6d2047", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 36, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47,65281-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788120512, "last_seen": 1789305704, "transport": "t", "ja3_hash": "382bf461327b7a16e4205fb4b5d1bf09", "ja3_variant_count": 1, "ja3_variants": [ "382bf461327b7a16e4205fb4b5d1bf09" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i431100_c7886603b240_d339722ba4af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i431100", "b": "c7886603b240", "c": "d339722ba4af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 43, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,11-10-35-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787527720, "last_seen": 1788493930, "transport": "t", "ja3_hash": "42ea9ce86effc99ac3305b3c203cccad", "ja3_variant_count": 1, "ja3_variants": [ "42ea9ce86effc99ac3305b3c203cccad" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36": 4, "Mozilla/5.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i4311ht_c7886603b240_aaee209e3cc1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i4311ht", "b": "c7886603b240", "c": "aaee209e3cc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 43, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 78, "first_seen": 1789747053, "last_seen": 1789833169, "transport": "t", "ja3_hash": "f80d3d09f61892c5846c854dd84ac403", "ja3_variant_count": 1, "ja3_variants": [ "f80d3d09f61892c5846c854dd84ac403" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36": 78 }, "ua_disagreement": false } }, { "hash": "t13i4311ht_c7886603b240_be8d12c1d91c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i4311ht", "b": "c7886603b240", "c": "be8d12c1d91c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 43, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788458106, "last_seen": 1788458131, "transport": "t", "ja3_hash": "db687c576d7ee0017b289fc05e0f8574", "ja3_variant_count": 1, "ja3_variants": [ "db687c576d7ee0017b289fc05e0f8574" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13i461000_0cb0c5806038_d41ae481755e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i461000", "b": "0cb0c5806038", "c": "d41ae481755e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 46, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-52393-52392-49327-49325-49245-49249-49195-49199-49326-49324-49244-49248-49188-49192-49267-49271-49187-49191-49266-49270-49162-49172-49161-49171-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 12, "first_seen": 1787984728, "last_seen": 1789660919, "transport": "t", "ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "ja3_variant_count": 1, "ja3_variants": [ "511534a5dbb144576d046b0d2aeb5fb7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13i871000_72303a6ce03a_24695f2957a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i871000", "b": "72303a6ce03a", "c": "24695f2957a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 87, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-5-22-51-57-53-10-47-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-154-153-69-68-49159-49169-49160-49170-19-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-132-150-65-7-255,11-10-35-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 165, "first_seen": 1787807806, "last_seen": 1789750925, "transport": "t", "ja3_hash": "b9f9f70d41f64b985a82dfad78bde5f2", "ja3_variant_count": 1, "ja3_variants": [ "b9f9f70d41f64b985a82dfad78bde5f2" ], "user_agents": { "\"Mozilla/5.0": 4, "Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/86.0.4240.111Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13i8711ht_c66346c74e42_14507d565a4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i8711ht", "b": "c66346c74e42", "c": "14507d565a4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 87, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-167-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-166-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787591550, "last_seen": 1788978544, "transport": "t", "ja3_hash": "1985e5fe14ed4a8da49339c80ff937a1", "ja3_variant_count": 1, "ja3_variants": [ "1985e5fe14ed4a8da49339c80ff937a1" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i950900_22c26c6111ac_3cecfd2c111c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i950900", "b": "22c26c6111ac", "c": "3cecfd2c111c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 95, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-49158-49168-49173-59-2-1-255,11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788929229, "last_seen": 1788929229, "transport": "t", "ja3_hash": "e13351d956e8bb19f99de4eab43c0bb2", "ja3_variant_count": 1, "ja3_variants": [ "e13351d956e8bb19f99de4eab43c0bb2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_2f94236428df", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "PQCrypta HTTP/3 scanner \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "2f94236428df", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,43-11-10-51-5-35-23-16-57-0-45-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9228, "first_seen": 1787447443, "last_seen": 1789897247, "transport": "q", "ja3_hash": "114f028919868e871efa215f1dcceef9", "ja3_variant_count": 8290, "ja3_variants": [ "114f028919868e871efa215f1dcceef9", "9822d35ef3997228ce8242d8aba65c9a", "25d5e5ccb7c3fd84da6858a18c3ae7b7", "4d1aa5addc59b220742152bc465f9947", "c4f92e3b8ef850297a406dc700104807", "47a21a96b62c89279b58105355aa9dfa", "7ec06076ee6e84abcd959c2297263ce6", "2577dde34b809c52f2754fa511144654", "c53bdf436ac0b4e9c4bbe6ef79a0c5ff", "040da7337bfa6952af1065c14dcd6e75", "73f68315d4ca0ae34873d97f0ec71fab", "2f50b7cef4a5739387e38dc96d7af97e" ], "user_agents": { "PQCrypta-HTTP3-Scanner/1.0": 3974 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_4bf6f83e6eb6", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "PQCrypta HTTP/3 scanner \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "4bf6f83e6eb6", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,5-45-57-0-11-23-10-51-13-43-16-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3490, "first_seen": 1787474396, "last_seen": 1789897246, "transport": "q", "ja3_hash": "aa341ea0f9bf84b19d84eda0553b9938", "ja3_variant_count": 3328, "ja3_variants": [ "aa341ea0f9bf84b19d84eda0553b9938", "39141acec579f7c848bdcb9906b012b6", "f3e9c2b354a967fc0c35e289ddf85912", "6cf38924d6472f79a69346db1b176446", "88e6eb2f9c3938b59200dbd4704c5108", "270dd7930135f89a99f16a9ddd2b5930", "bae6b099f3bb4a4f7003f486706c9d7f", "975d1b4ab40a6a3e7485f4f403b9f657", "cdfdef55a6dd51332e68c3bfffdc751a", "435b29a0e41c37a23eb787f5a7bfcf13", "ef4a488fec235d424e921a5a334eb839", "795d49c4dadfb5df2ab586edede29f0f" ], "user_agents": { "PQCrypta-HTTP3-Scanner/1.0": 65 }, "ua_disagreement": false } }, { "hash": "t13d301200_1d37bd780c83_55ac72f97122", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "PQCrypta IndexNow \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301200", "b": "1d37bd780c83", "c": "55ac72f97122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3597, "first_seen": 1787443194, "last_seen": 1789966807, "transport": "t", "ja3_hash": "284deaeae14ea5ddc96c5d7e59855422", "ja3_variant_count": 3, "ja3_variants": [ "284deaeae14ea5ddc96c5d7e59855422", "fb179fc2dbd327ae80d22546d3f6e18b", "e423472435aef3b83a831006b999a013" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 12, "IndexNow-PQCrypta/1.0": 3440, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/122.0.0.0 Safari/537.36": 3 }, "ua_disagreement": true } }, { "hash": "t13d3112h2_e8f1e7e78f70_d89d4c7b8e02", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "PQCrypta watchdog \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112h2", "b": "e8f1e7e78f70", "c": "d89d4c7b8e02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 111046, "first_seen": 1787442646, "last_seen": 1789968477, "transport": "t", "ja3_hash": "0149f47eabf9a20d0893e2a44e5a6323", "ja3_variant_count": 1, "ja3_variants": [ "0149f47eabf9a20d0893e2a44e5a6323" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 8332, "curl/8.18.0-DEV": 6803, "proxy-watchdog": 79285 }, "ua_disagreement": true } }, { "hash": "t13d561200_bc01e4e2260a_3bb33b5210f9", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "Site24x7 \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d561200", "b": "bc01e4e2260a", "c": "3bb33b5210f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 56, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-49160-49170-22-19-49155-49165-10-255,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4123, "first_seen": 1787443128, "last_seen": 1789967996, "transport": "t", "ja3_hash": "1875aec3e9d2d51ffde08cc376aedcff", "ja3_variant_count": 1, "ja3_variants": [ "1875aec3e9d2d51ffde08cc376aedcff" ], "user_agents": { "Site24x7": 4111 }, "ua_disagreement": false } }, { "hash": "t13i3514ht_8f004308c246_d27576f0e476", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "Infrawatch \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3514ht", "b": "8f004308c246", "c": "d27576f0e476", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 35, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-49191-49187-52394-158-159-103-107-51-57-60-49170-22-10-5-49169-49159-52243-52244,23-65281-10-11-35-16-5-34-51-43-13-45-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 199, "first_seen": 1787461203, "last_seen": 1789895617, "transport": "t", "ja3_hash": "90189170f2171f397898ade1c4de4367", "ja3_variant_count": 1, "ja3_variants": [ "90189170f2171f397898ade1c4de4367" ], "user_agents": { "Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)": 199 }, "ua_disagreement": false } }, { "hash": "t00d110500_3790f16dbcf6_5551bc6d1e9a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (5551bc6d1e9a) with 2 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t00d110500", "b": "3790f16dbcf6", "c": "5551bc6d1e9a", "properties": { "transport": "TCP", "tls_version": "unknown (00)", "sni": "server name sent", "cipher_count": 11, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49169-49159-49171-49161-49172-49162-5-47-53-49170-10,0-5-10-11-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 95, "first_seen": 1787495092, "last_seen": 1789949896, "transport": "t", "ja3_hash": "819a1ec4452f57faa06fea25528373c1", "ja3_variant_count": 1, "ja3_variants": [ "819a1ec4452f57faa06fea25528373c1" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t00i080600_dafb69683c10_b41aa53946ce", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t00i080600", "b": "dafb69683c10", "c": "b41aa53946ce", "properties": { "transport": "TCP", "tls_version": "unknown (00)", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 6, "alpn": null } }, "ja3_string": "769,10-47-53-49161-49162-49170-49171-49172,5-10-11-65281-15-18,23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 30, "first_seen": 1787469641, "last_seen": 1789965825, "transport": "t", "ja3_hash": "9ac060ae00112c1514e88f2858c37d14", "ja3_variant_count": 1, "ja3_variants": [ "9ac060ae00112c1514e88f2858c37d14" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t00i110400_3790f16dbcf6_3cfcf17d8064", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t00i110400", "b": "3790f16dbcf6", "c": "3cfcf17d8064", "properties": { "transport": "TCP", "tls_version": "unknown (00)", "sni": "no server name (IP literal)", "cipher_count": 11, "extension_count": 4, "alpn": null } }, "ja3_string": "769,49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 97, "first_seen": 1787506166, "last_seen": 1789949653, "transport": "t", "ja3_hash": "4efa2927cd9c5711813345d734439c0c", "ja3_variant_count": 1, "ja3_variants": [ "4efa2927cd9c5711813345d734439c0c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_0c65036c8509_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "0c65036c8509", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,58-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615175, "transport": "t", "ja3_hash": "0b7b7f0670f94778cb6e9fbcb190d590", "ja3_variant_count": 1, "ja3_variants": [ "0b7b7f0670f94778cb6e9fbcb190d590" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_1275cc1ca538_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "1275cc1ca538", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,3-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615170, "transport": "t", "ja3_hash": "45c77ffa3640617a36f48bc655fe6aae", "ja3_variant_count": 1, "ja3_variants": [ "45c77ffa3640617a36f48bc655fe6aae" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_14422b46a244_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "14422b46a244", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,9-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615169, "transport": "t", "ja3_hash": "7c56b75c3f1d7b18aded06f525be1da1", "ja3_variant_count": 1, "ja3_variants": [ "7c56b75c3f1d7b18aded06f525be1da1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_185cab9fea21_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "185cab9fea21", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,1-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825507, "last_seen": 1789615170, "transport": "t", "ja3_hash": "ffc812dd63fe6a5401c3e3871d1b9981", "ja3_variant_count": 1, "ja3_variants": [ "ffc812dd63fe6a5401c3e3871d1b9981" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_1c0a52334b2c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "1c0a52334b2c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,48-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615169, "transport": "t", "ja3_hash": "8a59e61cd6938f9441fbfd5c0618ebcb", "ja3_variant_count": 1, "ja3_variants": [ "8a59e61cd6938f9441fbfd5c0618ebcb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_1c131e13d449_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "1c131e13d449", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,15-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615172, "transport": "t", "ja3_hash": "fc18d564bdeac4b64832ec176210c0c3", "ja3_variant_count": 1, "ja3_variants": [ "fc18d564bdeac4b64832ec176210c0c3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_23061ef215d6_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "23061ef215d6", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,137-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615175, "transport": "t", "ja3_hash": "4993faf879f029360aa8a0c9af8bed3c", "ja3_variant_count": 1, "ja3_variants": [ "4993faf879f029360aa8a0c9af8bed3c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_2858a708d91c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "2858a708d91c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,4-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615170, "transport": "t", "ja3_hash": "34c5c1c012bbcc6d5e453cdbf8252117", "ja3_variant_count": 1, "ja3_variants": [ "34c5c1c012bbcc6d5e453cdbf8252117" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_2c202acb5b0d_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "2c202acb5b0d", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,154-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825506, "last_seen": 1789615166, "transport": "t", "ja3_hash": "a14d0e7dae973fb77ca9fdb1ede9e6d1", "ja3_variant_count": 1, "ja3_variants": [ "a14d0e7dae973fb77ca9fdb1ede9e6d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_2de5af831e68_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "2de5af831e68", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,65-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825508, "last_seen": 1789615169, "transport": "t", "ja3_hash": "2c8046b282a7e0774ebba08834650406", "ja3_variant_count": 1, "ja3_variants": [ "2c8046b282a7e0774ebba08834650406" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_30605b3abcde_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "30605b3abcde", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,17-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615169, "transport": "t", "ja3_hash": "a8e1b92a956b70db2409bc302d9f14c4", "ja3_variant_count": 1, "ja3_variants": [ "a8e1b92a956b70db2409bc302d9f14c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_35db378cb09f_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "35db378cb09f", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,51-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615172, "transport": "t", "ja3_hash": "c3c691ed4a9b02563c4b3f9748810ee3", "ja3_variant_count": 1, "ja3_variants": [ "c3c691ed4a9b02563c4b3f9748810ee3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_3c8714487106_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "3c8714487106", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,16-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615170, "transport": "t", "ja3_hash": "918daef135387a67ddf55fe5f3f2f269", "ja3_variant_count": 1, "ja3_variants": [ "918daef135387a67ddf55fe5f3f2f269" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_3f56bb683bdc_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "3f56bb683bdc", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,20-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615174, "transport": "t", "ja3_hash": "3e41a068ccc4dd82fc64eee06639f9fa", "ja3_variant_count": 1, "ja3_variants": [ "3e41a068ccc4dd82fc64eee06639f9fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_437c38fb20d7_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "437c38fb20d7", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,55-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825508, "last_seen": 1789615170, "transport": "t", "ja3_hash": "a44b0224387105d5c3562f685dad359d", "ja3_variant_count": 1, "ja3_variants": [ "a44b0224387105d5c3562f685dad359d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_462ecd6708d4_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "462ecd6708d4", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,27-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615174, "transport": "t", "ja3_hash": "00f545d6fdc7e9fbbbb1c4cc3d7a5964", "ja3_variant_count": 1, "ja3_variants": [ "00f545d6fdc7e9fbbbb1c4cc3d7a5964" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_484ebc7627f0_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "484ebc7627f0", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,56-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615173, "transport": "t", "ja3_hash": "8f081547b577718378d89926db8aa9d2", "ja3_variant_count": 1, "ja3_variants": [ "8f081547b577718378d89926db8aa9d2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_4a513bce9f12_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "4a513bce9f12", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,68-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615169, "transport": "t", "ja3_hash": "0521f512de771d542a04d17bb29de0f3", "ja3_variant_count": 1, "ja3_variants": [ "0521f512de771d542a04d17bb29de0f3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_515ebe86e7c3_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "515ebe86e7c3", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,49-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615171, "transport": "t", "ja3_hash": "391dffd9e8ec39129178abc23739265c", "ja3_variant_count": 1, "ja3_variants": [ "391dffd9e8ec39129178abc23739265c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_593aba79ccba_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "593aba79ccba", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,18-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825507, "last_seen": 1789615165, "transport": "t", "ja3_hash": "191d5bf0c0d1237c1795a8fcb485bf60", "ja3_variant_count": 1, "ja3_variants": [ "191d5bf0c0d1237c1795a8fcb485bf60" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_6376cb8fadaa_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "6376cb8fadaa", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,57-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615172, "transport": "t", "ja3_hash": "e58ca349f51b598488a382c74eea4d22", "ja3_variant_count": 1, "ja3_variants": [ "e58ca349f51b598488a382c74eea4d22" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_671e0306a5cb_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "671e0306a5cb", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,19-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615169, "transport": "t", "ja3_hash": "4c6716cc99c468f1b11c440c5bee360f", "ja3_variant_count": 1, "ja3_variants": [ "4c6716cc99c468f1b11c440c5bee360f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_69d181a99895_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "69d181a99895", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,152-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825506, "last_seen": 1789615167, "transport": "t", "ja3_hash": "0af9260de52bdb863cc7aedf229cd61f", "ja3_variant_count": 1, "ja3_variants": [ "0af9260de52bdb863cc7aedf229cd61f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_6d6b3751bd69_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "6d6b3751bd69", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,153-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615170, "transport": "t", "ja3_hash": "426e1b972b56951df4747a2a1c1ba43a", "ja3_variant_count": 1, "ja3_variants": [ "426e1b972b56951df4747a2a1c1ba43a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_72fe80e83b5d_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "72fe80e83b5d", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,13-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615169, "transport": "t", "ja3_hash": "80e3de44341ad6a247c665ae8bc4c878", "ja3_variant_count": 1, "ja3_variants": [ "80e3de44341ad6a247c665ae8bc4c878" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_7ba938555a01_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "7ba938555a01", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,25-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615178, "transport": "t", "ja3_hash": "4b7205901eea041156c89665181ac95b", "ja3_variant_count": 1, "ja3_variants": [ "4b7205901eea041156c89665181ac95b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_85064055552b_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "85064055552b", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,151-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615173, "transport": "t", "ja3_hash": "9e20bbd1504dfc177596e1f14620be6e", "ja3_variant_count": 1, "ja3_variants": [ "9e20bbd1504dfc177596e1f14620be6e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_86ae22adfd52_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "86ae22adfd52", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,52-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825508, "last_seen": 1789615168, "transport": "t", "ja3_hash": "f58779091229ceeb548697af87e22e6a", "ja3_variant_count": 1, "ja3_variants": [ "f58779091229ceeb548697af87e22e6a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_8764e5090277_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "8764e5090277", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,135-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825508, "last_seen": 1789615169, "transport": "t", "ja3_hash": "db3fb008211c8bdff8943a3d2e1d2af2", "ja3_variant_count": 1, "ja3_variants": [ "db3fb008211c8bdff8943a3d2e1d2af2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_8cde4933ab6b_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "8cde4933ab6b", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,26-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615172, "transport": "t", "ja3_hash": "d0534e346cf00959825a6c2162d3bc6b", "ja3_variant_count": 1, "ja3_variants": [ "d0534e346cf00959825a6c2162d3bc6b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_8d2fb8454607_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "8d2fb8454607", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,70-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615174, "transport": "t", "ja3_hash": "2b7ad8c3805d5c20182f92bba8def66d", "ja3_variant_count": 1, "ja3_variants": [ "2b7ad8c3805d5c20182f92bba8def66d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_9cb11800989c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "9cb11800989c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,155-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615170, "transport": "t", "ja3_hash": "54eed52f3381566e0bf0816bb0d22d49", "ja3_variant_count": 1, "ja3_variants": [ "54eed52f3381566e0bf0816bb0d22d49" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_a0f473027383_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "a0f473027383", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,2-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615174, "transport": "t", "ja3_hash": "f44083d14857e87338a8b396c3bca7ac", "ja3_variant_count": 1, "ja3_variants": [ "f44083d14857e87338a8b396c3bca7ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_a5878986a7c9_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "a5878986a7c9", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,47-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615172, "transport": "t", "ja3_hash": "d49dd2dac22aba9882aa9d2b62ae619c", "ja3_variant_count": 1, "ja3_variants": [ "d49dd2dac22aba9882aa9d2b62ae619c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_a8d286a27066_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "a8d286a27066", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,23-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615172, "transport": "t", "ja3_hash": "e891627a1f2c8172718f670aa3031515", "ja3_variant_count": 1, "ja3_variants": [ "e891627a1f2c8172718f670aa3031515" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_b0ed54973b0f_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "b0ed54973b0f", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,50-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615171, "transport": "t", "ja3_hash": "9bf3632ef517c4fbbe67216c43e16620", "ja3_variant_count": 1, "ja3_variants": [ "9bf3632ef517c4fbbe67216c43e16620" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_bae431c474f8_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "bae431c474f8", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,66-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615173, "transport": "t", "ja3_hash": "ea8c34877a6c934fcea39bb63e9c4e0d", "ja3_variant_count": 1, "ja3_variants": [ "ea8c34877a6c934fcea39bb63e9c4e0d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_c259c416e32c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "c259c416e32c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,12-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615168, "transport": "t", "ja3_hash": "0e9a732e8288b157063a5f95e3994eb8", "ja3_variant_count": 1, "ja3_variants": [ "0e9a732e8288b157063a5f95e3994eb8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_c38774e7e0a0_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "c38774e7e0a0", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,22-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825506, "last_seen": 1789615167, "transport": "t", "ja3_hash": "8de16512b7a878030ed784e4405722ac", "ja3_variant_count": 1, "ja3_variants": [ "8de16512b7a878030ed784e4405722ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_c3df0a865ad8_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "c3df0a865ad8", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,150-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615173, "transport": "t", "ja3_hash": "d71748d4a275fdb70d6caeae1de9e2ac", "ja3_variant_count": 1, "ja3_variants": [ "d71748d4a275fdb70d6caeae1de9e2ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_c9fe23a5d87c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "c9fe23a5d87c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,67-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615173, "transport": "t", "ja3_hash": "9dd6db55b1028e55f04504a2e63eca23", "ja3_variant_count": 1, "ja3_variants": [ "9dd6db55b1028e55f04504a2e63eca23" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_d25758f9cc88_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "d25758f9cc88", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,24-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615170, "transport": "t", "ja3_hash": "0609e29c3f270a035f022b4983ef8ae4", "ja3_variant_count": 1, "ja3_variants": [ "0609e29c3f270a035f022b4983ef8ae4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_d83d06a7b5eb_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "d83d06a7b5eb", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,134-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615174, "transport": "t", "ja3_hash": "319373dd6d69af7291a745d250172c50", "ja3_variant_count": 1, "ja3_variants": [ "319373dd6d69af7291a745d250172c50" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_d99cf322fdea_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "d99cf322fdea", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,133-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615170, "transport": "t", "ja3_hash": "147e342b57ffa298b544031c9ea4a9a0", "ja3_variant_count": 1, "ja3_variants": [ "147e342b57ffa298b544031c9ea4a9a0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_da5e85b893fc_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "da5e85b893fc", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,10-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615175, "transport": "t", "ja3_hash": "627eb71a8d63b593f4982de6cfab6058", "ja3_variant_count": 1, "ja3_variants": [ "627eb71a8d63b593f4982de6cfab6058" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_e03107c9d76e_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "e03107c9d76e", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,5-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825507, "last_seen": 1789615166, "transport": "t", "ja3_hash": "0b916017b4c99b13bbc1d61f49282e22", "ja3_variant_count": 1, "ja3_variants": [ "0b916017b4c99b13bbc1d61f49282e22" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_e530588400b6_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "e530588400b6", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,132-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615170, "transport": "t", "ja3_hash": "f3feb64f82841303ae55afdb888c02a6", "ja3_variant_count": 1, "ja3_variants": [ "f3feb64f82841303ae55afdb888c02a6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_ea1f27bcdcc2_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "ea1f27bcdcc2", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,136-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825508, "last_seen": 1789615166, "transport": "t", "ja3_hash": "5a58fd1878ad1606933a1757dbcb1202", "ja3_variant_count": 1, "ja3_variants": [ "5a58fd1878ad1606933a1757dbcb1202" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_ed19d00bad77_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "ed19d00bad77", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,21-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615168, "transport": "t", "ja3_hash": "008f240c56638283220461d58c217a3e", "ja3_variant_count": 1, "ja3_variants": [ "008f240c56638283220461d58c217a3e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_eea8af79bad9_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "eea8af79bad9", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,69-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825508, "last_seen": 1789615170, "transport": "t", "ja3_hash": "3c755f49ae8569ed337505c1bb053e97", "ja3_variant_count": 1, "ja3_variants": [ "3c755f49ae8569ed337505c1bb053e97" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_f2d8273d9564_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "f2d8273d9564", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,53-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615171, "transport": "t", "ja3_hash": "a3a83140e61f127cdfb03d8d7abe7085", "ja3_variant_count": 1, "ja3_variants": [ "a3a83140e61f127cdfb03d8d7abe7085" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_f4b95c39a23e_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "f4b95c39a23e", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,6-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615169, "transport": "t", "ja3_hash": "8e707082d66c38a68ad54ad5b860fc50", "ja3_variant_count": 1, "ja3_variants": [ "8e707082d66c38a68ad54ad5b860fc50" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_fa20206d2144_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "fa20206d2144", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,7-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615172, "transport": "t", "ja3_hash": "23d0575922ff8c016c6b87dfa0961849", "ja3_variant_count": 1, "ja3_variants": [ "23d0575922ff8c016c6b87dfa0961849" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_fbc32bd69299_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "fbc32bd69299", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,8-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825506, "last_seen": 1789615167, "transport": "t", "ja3_hash": "f1fb6ca22126d08f70fbebf764760962", "ja3_variant_count": 1, "ja3_variants": [ "f1fb6ca22126d08f70fbebf764760962" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_fd2d85721aa5_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "fd2d85721aa5", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,54-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825508, "last_seen": 1789615168, "transport": "t", "ja3_hash": "56463cfba840bdc7340a6c015b8f4066", "ja3_variant_count": 1, "ja3_variants": [ "56463cfba840bdc7340a6c015b8f4066" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_049d0968ef63_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "049d0968ef63", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49174-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615173, "transport": "t", "ja3_hash": "fd741510c1629880e66387ed56ffd6b7", "ja3_variant_count": 1, "ja3_variants": [ "fd741510c1629880e66387ed56ffd6b7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_0d62a58dd912_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "0d62a58dd912", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49169-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615171, "transport": "t", "ja3_hash": "f6633a778fa94cf468c262a61c446122", "ja3_variant_count": 1, "ja3_variants": [ "f6633a778fa94cf468c262a61c446122" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_2ac205266896_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "2ac205266896", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49173-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615173, "transport": "t", "ja3_hash": "f5bd74bb3aa2b083fe5baf397837404b", "ja3_variant_count": 1, "ja3_variants": [ "f5bd74bb3aa2b083fe5baf397837404b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_48762405b09c_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "48762405b09c", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49157-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825508, "last_seen": 1789615169, "transport": "t", "ja3_hash": "bb2a8dc59a8668efd9f4eac086f79e6f", "ja3_variant_count": 1, "ja3_variants": [ "bb2a8dc59a8668efd9f4eac086f79e6f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_4eff32302ec7_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "4eff32302ec7", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49160-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615172, "transport": "t", "ja3_hash": "a065d391f6d1113bf6131e0f65207999", "ja3_variant_count": 1, "ja3_variants": [ "a065d391f6d1113bf6131e0f65207999" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_4f4bd29a6b59_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "4f4bd29a6b59", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49175-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825508, "last_seen": 1789615169, "transport": "t", "ja3_hash": "b5bf8387a4d59ca2aedc7a7f9f8afd25", "ja3_variant_count": 1, "ja3_variants": [ "b5bf8387a4d59ca2aedc7a7f9f8afd25" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_55a2bbf9cbd7_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "55a2bbf9cbd7", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49164-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615169, "transport": "t", "ja3_hash": "b21e8f6cc931a4f610cca5e0d89154c4", "ja3_variant_count": 1, "ja3_variants": [ "b21e8f6cc931a4f610cca5e0d89154c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_57ba72230e7a_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "57ba72230e7a", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49167-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615169, "transport": "t", "ja3_hash": "c7955263fb5755b191c7b8af8b011163", "ja3_variant_count": 1, "ja3_variants": [ "c7955263fb5755b191c7b8af8b011163" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_59980b593f60_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "59980b593f60", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49176-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615169, "transport": "t", "ja3_hash": "20b543eb191018e555ec27ae874ab521", "ja3_variant_count": 1, "ja3_variants": [ "20b543eb191018e555ec27ae874ab521" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_5b44afd80a2d_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "5b44afd80a2d", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49156-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615172, "transport": "t", "ja3_hash": "f076b4a5e2fd4408a329d4f9dfda478f", "ja3_variant_count": 1, "ja3_variants": [ "f076b4a5e2fd4408a329d4f9dfda478f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_68cd44b4e773_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "68cd44b4e773", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49162-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615170, "transport": "t", "ja3_hash": "ef4bf16a753ddfcf0e8831cb9f52e475", "ja3_variant_count": 1, "ja3_variants": [ "ef4bf16a753ddfcf0e8831cb9f52e475" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_89e01831f9a8_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "89e01831f9a8", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49153-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615168, "transport": "t", "ja3_hash": "69dc0d3a7f413f1d3494b2f5ff96b21e", "ja3_variant_count": 1, "ja3_variants": [ "69dc0d3a7f413f1d3494b2f5ff96b21e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_8fc24edd70fe_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "8fc24edd70fe", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49163-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615173, "transport": "t", "ja3_hash": "105c3296d1d9b5d35cc7f018a4dad282", "ja3_variant_count": 1, "ja3_variants": [ "105c3296d1d9b5d35cc7f018a4dad282" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_9b38dd297dfe_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "9b38dd297dfe", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49168-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615170, "transport": "t", "ja3_hash": "f0fd3766ab6ea6822c59a578e1d5349c", "ja3_variant_count": 1, "ja3_variants": [ "f0fd3766ab6ea6822c59a578e1d5349c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_a0546e0689fc_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "a0546e0689fc", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49171-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615167, "transport": "t", "ja3_hash": "3d45a6fbf32ad6468c66beaee3a193eb", "ja3_variant_count": 1, "ja3_variants": [ "3d45a6fbf32ad6468c66beaee3a193eb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_a89416eb2da9_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "a89416eb2da9", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49177-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615171, "transport": "t", "ja3_hash": "7012d5113d653e86575e3c009ef57ce4", "ja3_variant_count": 1, "ja3_variants": [ "7012d5113d653e86575e3c009ef57ce4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_bad2b1bd13d4_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "bad2b1bd13d4", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49155-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615172, "transport": "t", "ja3_hash": "56a2d8d43e1c7c58cf1d3c0a6a266431", "ja3_variant_count": 1, "ja3_variants": [ "56a2d8d43e1c7c58cf1d3c0a6a266431" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_c4610a930072_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "c4610a930072", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49159-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615172, "transport": "t", "ja3_hash": "3e8278c7cafc262fa5568be5e1b4d38c", "ja3_variant_count": 1, "ja3_variants": [ "3e8278c7cafc262fa5568be5e1b4d38c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_c66b7cee1896_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "c66b7cee1896", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49161-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825508, "last_seen": 1789615170, "transport": "t", "ja3_hash": "fb6c5d992b10031b6ae404aaa9451a46", "ja3_variant_count": 1, "ja3_variants": [ "fb6c5d992b10031b6ae404aaa9451a46" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_cc27769a2ea2_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "cc27769a2ea2", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49165-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825508, "last_seen": 1789615167, "transport": "t", "ja3_hash": "8297baccfc07ffa8d13e3644678e522a", "ja3_variant_count": 1, "ja3_variants": [ "8297baccfc07ffa8d13e3644678e522a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_d0ac5cb1209a_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "d0ac5cb1209a", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49172-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825506, "last_seen": 1789615168, "transport": "t", "ja3_hash": "d2f789a95d9fc517a14f0fd38b038e8c", "ja3_variant_count": 1, "ja3_variants": [ "d2f789a95d9fc517a14f0fd38b038e8c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_d576ba9a1b51_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "d576ba9a1b51", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49154-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825508, "last_seen": 1789615169, "transport": "t", "ja3_hash": "24c962e6900b80aff311e22bc7051b5f", "ja3_variant_count": 1, "ja3_variants": [ "24c962e6900b80aff311e22bc7051b5f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_efa2d734833b_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "efa2d734833b", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49158-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825505, "last_seen": 1789615167, "transport": "t", "ja3_hash": "8720b2322a28a280b38256f84596581c", "ja3_variant_count": 1, "ja3_variants": [ "8720b2322a28a280b38256f84596581c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_f17337cd55b5_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "f17337cd55b5", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49166-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615168, "transport": "t", "ja3_hash": "6229126190e013f5e256b7863adacefc", "ja3_variant_count": 1, "ja3_variants": [ "6229126190e013f5e256b7863adacefc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_f3042cbcf579_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "f3042cbcf579", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49170-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615172, "transport": "t", "ja3_hash": "14960d88ecbd35d1a0fd74a33f53151f", "ja3_variant_count": 1, "ja3_variants": [ "14960d88ecbd35d1a0fd74a33f53151f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d070700_c50f5591e341_661ff8826348", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d070700", "b": "c50f5591e341", "c": "661ff8826348", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 7, "extension_count": 7, "alpn": null } }, "ja3_string": "769,49162-49161-49172-49171-53-47-10,0-5-10-11-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789450889, "last_seen": 1789450892, "transport": "t", "ja3_hash": "1138de370e523e824bbca92d049a3777", "ja3_variant_count": 1, "ja3_variants": [ "1138de370e523e824bbca92d049a3777" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d080700_dafb69683c10_18ee6cfe2d80", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d080700", "b": "dafb69683c10", "c": "18ee6cfe2d80", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 8, "extension_count": 7, "alpn": null } }, "ja3_string": "769,49171-49161-49172-49162-47-53-49170-10,0-5-10-11-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 95, "first_seen": 1787495096, "last_seen": 1789949893, "transport": "t", "ja3_hash": "2bc74c78d8230f1675231a007f1155d0", "ja3_variant_count": 1, "ja3_variants": [ "2bc74c78d8230f1675231a007f1155d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d090600_c491f621fb4c_80d8baa1f8cb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d090600", "b": "c491f621fb4c", "c": "80d8baa1f8cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 9, "extension_count": 6, "alpn": null } }, "ja3_string": "769,49162-49172-57-49161-49171-51-53-47-255,0-11-10-35-22-23,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 12, "first_seen": 1787697751, "last_seen": 1789425146, "transport": "t", "ja3_hash": "c6dbf3152a545382a95425e390e2d2e8", "ja3_variant_count": 1, "ja3_variants": [ "c6dbf3152a545382a95425e390e2d2e8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d110700_3790f16dbcf6_18ee6cfe2d80", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d110700", "b": "3790f16dbcf6", "c": "18ee6cfe2d80", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 11, "extension_count": 7, "alpn": null } }, "ja3_string": "769,10-47-53-49161-49162-49170-49171-49172-5-49159-49169,0-5-10-11-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787969613, "last_seen": 1789792893, "transport": "t", "ja3_hash": "e989acc7bf5b039f3e2ae950c6a38aeb", "ja3_variant_count": 1, "ja3_variants": [ "e989acc7bf5b039f3e2ae950c6a38aeb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d130300_48b83dc3bfb9_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d130300", "b": "48b83dc3bfb9", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 13, "extension_count": 3, "alpn": null } }, "ja3_string": "769,255-49162-49172-57-56-49157-49167-49161-49171-51-50-49156-49166,0-10-11,14-13-25-28-11-12-27-24-9-10-26-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787710534, "last_seen": 1789193129, "transport": "t", "ja3_hash": "514be2763eae0143869b0b4de27dbf40", "ja3_variant_count": 1, "ja3_variants": [ "514be2763eae0143869b0b4de27dbf40" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d140600_74fc3de17c53_39291a6d1b56", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d140600", "b": "74fc3de17c53", "c": "39291a6d1b56", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 14, "extension_count": 6, "alpn": null } }, "ja3_string": "769,49162-49161-49172-49171-57-51-53-47-10-56-50-19-5-4,0-10-11-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788497955, "last_seen": 1789653807, "transport": "t", "ja3_hash": "235a856727c14dba889ddee0a38dd2f2", "ja3_variant_count": 1, "ja3_variants": [ "235a856727c14dba889ddee0a38dd2f2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d170600_89907b424de5_80d8baa1f8cb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d170600", "b": "89907b424de5", "c": "80d8baa1f8cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 17, "extension_count": 6, "alpn": null } }, "ja3_string": "769,49171-49161-49172-49162-51-56-57-50-47-53-136-135-69-68-132-65-255,0-11-10-35-22-23,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788750554, "last_seen": 1788750554, "transport": "t", "ja3_hash": "5359ec34eb388044f03ba3d8d2ffed9b", "ja3_variant_count": 1, "ja3_variants": [ "5359ec34eb388044f03ba3d8d2ffed9b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d210500_1e0f66cc3f83_5551bc6d1e9a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d210500", "b": "1e0f66cc3f83", "c": "5551bc6d1e9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 21, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49160-57-51-22-4-20-21-8-6-3,0-5-10-11-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 28, "first_seen": 1787464629, "last_seen": 1789868668, "transport": "t", "ja3_hash": "aaed20a72e1ed040b4a19deae4694250", "ja3_variant_count": 1, "ja3_variants": [ "aaed20a72e1ed040b4a19deae4694250" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d420300_4a5d165148b5_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d420300", "b": "4a5d165148b5", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 42, "extension_count": 3, "alpn": null } }, "ja3_string": "769,4-5-10-13-16-19-22-47-48-49-50-51-53-54-55-56-57-65-68-69-102-132-135-136-150-255-49154-49155-49156-49157-49159-49160-49161-49162-49164-49165-49166-49167-49169-49170-49171-49172,0-11-10,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17-29,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787509860, "last_seen": 1789900800, "transport": "t", "ja3_hash": "4bb0894d67675912496f921f6d6a70e6", "ja3_variant_count": 1, "ja3_variants": [ "4bb0894d67675912496f921f6d6a70e6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i040200_058957366436_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i040200", "b": "058957366436", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 2, "alpn": null } }, "ja3_string": "769,49185-49178-49181-49184,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748809, "last_seen": 1789646816, "transport": "t", "ja3_hash": "ef48cb39a551b26f56be4a1eab4147ad", "ja3_variant_count": 1, "ja3_variants": [ "ef48cb39a551b26f56be4a1eab4147ad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i040700_cefcabfea53d_28adf769107b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i040700", "b": "cefcabfea53d", "c": "28adf769107b", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 7, "alpn": null } }, "ja3_string": "769,49161-49171-49162-49172,11-65281-23-18-5-10-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 153, "first_seen": 1787448773, "last_seen": 1789950289, "transport": "t", "ja3_hash": "af232ab01c5a432d1148b4f805c5df16", "ja3_variant_count": 1, "ja3_variants": [ "af232ab01c5a432d1148b4f805c5df16" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i070500_c50f5591e341_1a3805c3aa63", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i070500", "b": "c50f5591e341", "c": "1a3805c3aa63", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 7, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49162-49161-49172-49171-53-47-10,10-11-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788917186, "last_seen": 1788917187, "transport": "t", "ja3_hash": "fc54e0d16d9764783542f0146a98b300", "ja3_variant_count": 1, "ja3_variants": [ "fc54e0d16d9764783542f0146a98b300" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i080600_dafb69683c10_166ed56ebb15", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i080600", "b": "dafb69683c10", "c": "166ed56ebb15", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 6, "alpn": null } }, "ja3_string": "769,49171-49161-49172-49162-47-53-49170-10,5-10-11-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 106, "first_seen": 1787506167, "last_seen": 1789949651, "transport": "t", "ja3_hash": "8dace756ca50d2b376c065ba937de663", "ja3_variant_count": 1, "ja3_variants": [ "8dace756ca50d2b376c065ba937de663" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i150700_0dfbaf47f5cc_e144c465795a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i150700", "b": "0dfbaf47f5cc", "c": "e144c465795a", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "769,49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-53-47-255,5-10-11-17-23-35-43,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788737396, "last_seen": 1788737396, "transport": "t", "ja3_hash": "58f3ce9fd48c9e7e39947514ef7f51fa", "ja3_variant_count": 1, "ja3_variants": [ "58f3ce9fd48c9e7e39947514ef7f51fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_13a2a23d501b_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "13a2a23d501b", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182-49185-49178-49181-49184,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820550, "last_seen": 1789485430, "transport": "t", "ja3_hash": "3dd271080769b41ca30134e5a6d6c6bd", "ja3_variant_count": 1, "ja3_variants": [ "3dd271080769b41ca30134e5a6d6c6bd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_1715b94e3896_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "1715b94e3896", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,98-97-96-100-8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748806, "last_seen": 1789646814, "transport": "t", "ja3_hash": "8b64988acee4968c6c9ccf393390bf70", "ja3_variant_count": 1, "ja3_variants": [ "8b64988acee4968c6c9ccf393390bf70" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_1e98fdfb27e9_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "1e98fdfb27e9", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49411-49413-49409-49412-49414-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748808, "last_seen": 1789646816, "transport": "t", "ja3_hash": "df9477fa616f1460293a35f8ed101e9c", "ja3_variant_count": 1, "ja3_variants": [ "df9477fa616f1460293a35f8ed101e9c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_67f0ca237a44_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "67f0ca237a44", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138-98-97-96-100,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820548, "last_seen": 1789485428, "transport": "t", "ja3_hash": "71252f9d7847c2f1fe7d4f27fcdffe0f", "ja3_variant_count": 1, "ja3_variants": [ "71252f9d7847c2f1fe7d4f27fcdffe0f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_a3acda31d846_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "a3acda31d846", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787820546, "last_seen": 1789646816, "transport": "t", "ja3_hash": "d3b255a7a10be1525299b19c5b91a217", "ja3_variant_count": 2, "ja3_variants": [ "d3b255a7a10be1525299b19c5b91a217", "6de77e9ec18814ad2fa29b71daba7e40" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_e31a90cd0803_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "e31a90cd0803", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787820544, "last_seen": 1789646812, "transport": "t", "ja3_hash": "57af18b1ec1e94f633ec483f6d4712a7", "ja3_variant_count": 2, "ja3_variants": [ "57af18b1ec1e94f633ec483f6d4712a7", "0145ded955e8e369b284596c831c152d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_e7b476f9520b_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "e7b476f9520b", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787820550, "last_seen": 1789646814, "transport": "t", "ja3_hash": "b6e02a6390c3ee8685503e1e18094c85", "ja3_variant_count": 2, "ja3_variants": [ "b6e02a6390c3ee8685503e1e18094c85", "f0fcf0f58913a461bfe56c02056bf6aa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_f559eb9565fd_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "f559eb9565fd", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787820549, "last_seen": 1789646817, "transport": "t", "ja3_hash": "f73a537ea3cb074d98e4e7f6f049b5bc", "ja3_variant_count": 2, "ja3_variants": [ "f73a537ea3cb074d98e4e7f6f049b5bc", "74c653cc1772002464b804a19e77e170" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i990200_0df3f6915705_357e3bc58f3d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i990200", "b": "0df3f6915705", "c": "357e3bc58f3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 99, "extension_count": 2, "alpn": null } }, "ja3_string": "769,0-195-49239-150-41-199-49241-149-74-49229-49258-186-102-100-49202-19-49321-49413-18-66-49322-49231-49201-49266-49265-98-49310-14-103-49221-49184-45-49186-166-133-15-49197-194-30-49288-49318-33-49293-49222-49189-49214-49169-65-49301-189-142-56-49312-49323-49172-49262-143-49190-101-184-171-49302-49161-49268-49213-49319-88-49198-49-12-49196-49232-49165-44-52398-73-38-49206-49164-120-139-49154-52395-174-49273-49299-42-146-151-49209-49211-125-46-49192-49305-29-25-159-16-4-81-52-158-92-71-50-49325-49228-49320-27-105-165-96-53250-68-87-131-72-198-17-11-49220-70-188-78-49167-49277-129-20-154-49179-49298-49259-3-23-4871-49287-116-49260-4869-4868-55-49316-4867-26-4866-49257-4865-49175-196-49324-65278-53253-49295-22-173-49193-49210-13-53249-52397-52396-106-52394-136-52392-52245-49411-52244-10-135-49414-187-49153-77-84-109-49328-148-49300-49410-69-144-49233-49409-169-130-85-49333-49332-49270-49330-49234-52243-49243-192-140-147-49163-132-183-49326-49204-65279-190-168-49315-49191-6-49170-49156-49313-49176-156-49309-172-49237-49308-32-49307-49296-49306-49304-49253-49303-53-49297-53251-49223-8-49294-76-79-137-49292-4870-49181-49290-49289-49286-49203-121-49166-54-49285-145-49284-51-155-49282-176-49281-134-49280-49279-49278-49276-49240-49275-49274-180-49272-49255-49271-49331-97-49254-49267-49311-9-49263-49261-49205-49291-49185-48-49256-49160-24-67-49269-49252-64-175-63-49251-49250-153-35-163-49249-49248-60-49226-80-86-39-49246-49245-49244-49327-177-49242-108-89-107-162-49314-21-49329-49230-170-114-49227-49207-49224-1-49219-37-99-49218-49216-49215-157-49171-49208-7-43-49225-49200-49195-49182-49183-141-49194-49180-49187-2-49188-49178-197-91-49177-152-49173-49168-82-49162-36-49159-49158-182-49235-49155-193-161-31-179-104-191-49317-185-49157-181-28-178-49408-164-160-49212-49264-49283-49174-49412-61-57-49199-138-128-47-52393-75-126-59-124-119-115-49236-49217-90-5-49238-167-83-49247-62-58-40-34,10-15,23-24-25-29-256-4588,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 4871, "name": "4871 (0x1307)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 4870, "name": "4870 (0x1306)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1788737425, "last_seen": 1789364936, "transport": "t", "ja3_hash": "43f491788326492ae75d8b30340e83fb", "ja3_variant_count": 5, "ja3_variants": [ "43f491788326492ae75d8b30340e83fb", "d90e019b52211e0913fc2a15e6a7d461", "a9291424595b1cf0aba6f78f8d16eb5e", "78168602482c727689d4c0105f470b96", "081cfdeb15c3d26d2c5298cc3b2c489e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_0c65036c8509_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "0c65036c8509", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,58-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615162, "transport": "t", "ja3_hash": "edabd89505a0db3053780c9f2e11a51c", "ja3_variant_count": 1, "ja3_variants": [ "edabd89505a0db3053780c9f2e11a51c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_1275cc1ca538_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "1275cc1ca538", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,3-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615162, "transport": "t", "ja3_hash": "a9ac965462277f4f7bd009b91724b6e9", "ja3_variant_count": 1, "ja3_variants": [ "a9ac965462277f4f7bd009b91724b6e9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_14422b46a244_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "14422b46a244", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,9-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615157, "transport": "t", "ja3_hash": "3f09774b4d8319c6773b51318c0045be", "ja3_variant_count": 1, "ja3_variants": [ "3f09774b4d8319c6773b51318c0045be" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_185cab9fea21_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "185cab9fea21", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,1-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615164, "transport": "t", "ja3_hash": "9c4361562f8dbca42c849c680c7402a3", "ja3_variant_count": 1, "ja3_variants": [ "9c4361562f8dbca42c849c680c7402a3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_1c0a52334b2c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "1c0a52334b2c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,48-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825522, "last_seen": 1789615165, "transport": "t", "ja3_hash": "173a7880e2d1fa3dbfcd95ebb7b650a4", "ja3_variant_count": 1, "ja3_variants": [ "173a7880e2d1fa3dbfcd95ebb7b650a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_1c131e13d449_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "1c131e13d449", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,15-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825520, "last_seen": 1789615162, "transport": "t", "ja3_hash": "aa0f342e223668779dc8eb1fb7d920d8", "ja3_variant_count": 1, "ja3_variants": [ "aa0f342e223668779dc8eb1fb7d920d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_23061ef215d6_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "23061ef215d6", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,137-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825522, "last_seen": 1789615165, "transport": "t", "ja3_hash": "65cc4be7b7eac21328d21548cafc6068", "ja3_variant_count": 1, "ja3_variants": [ "65cc4be7b7eac21328d21548cafc6068" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_2858a708d91c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "2858a708d91c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,4-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825521, "last_seen": 1789615165, "transport": "t", "ja3_hash": "21d51028d0483349cc34e258eea575bf", "ja3_variant_count": 1, "ja3_variants": [ "21d51028d0483349cc34e258eea575bf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_2c202acb5b0d_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "2c202acb5b0d", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,154-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825520, "last_seen": 1789615165, "transport": "t", "ja3_hash": "01d9475c62a43afb65931bda06f549ee", "ja3_variant_count": 1, "ja3_variants": [ "01d9475c62a43afb65931bda06f549ee" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_2de5af831e68_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "2de5af831e68", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,65-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825521, "last_seen": 1789615165, "transport": "t", "ja3_hash": "b56b10234bbf794956d34ecfec984dd4", "ja3_variant_count": 1, "ja3_variants": [ "b56b10234bbf794956d34ecfec984dd4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_30605b3abcde_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "30605b3abcde", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,17-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825521, "last_seen": 1789615160, "transport": "t", "ja3_hash": "f99de2d28272883454e535c6a7e8319a", "ja3_variant_count": 1, "ja3_variants": [ "f99de2d28272883454e535c6a7e8319a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_35db378cb09f_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "35db378cb09f", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,51-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615163, "transport": "t", "ja3_hash": "9a47e517beacdc548a73dccca5377b22", "ja3_variant_count": 1, "ja3_variants": [ "9a47e517beacdc548a73dccca5377b22" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_3c8714487106_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "3c8714487106", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,16-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825521, "last_seen": 1789615164, "transport": "t", "ja3_hash": "72caabd73136ca8c599ecccc358abd2a", "ja3_variant_count": 1, "ja3_variants": [ "72caabd73136ca8c599ecccc358abd2a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_3f56bb683bdc_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "3f56bb683bdc", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,20-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615162, "transport": "t", "ja3_hash": "9ed9b9455a55502245e101214170d71b", "ja3_variant_count": 1, "ja3_variants": [ "9ed9b9455a55502245e101214170d71b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_437c38fb20d7_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "437c38fb20d7", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,55-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615159, "transport": "t", "ja3_hash": "c9102e0ced8828c7ab733ad648c431b5", "ja3_variant_count": 1, "ja3_variants": [ "c9102e0ced8828c7ab733ad648c431b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_462ecd6708d4_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "462ecd6708d4", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,27-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615165, "transport": "t", "ja3_hash": "68c64d039d2b709dc4e6c99f239d68d3", "ja3_variant_count": 1, "ja3_variants": [ "68c64d039d2b709dc4e6c99f239d68d3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_484ebc7627f0_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "484ebc7627f0", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,56-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615163, "transport": "t", "ja3_hash": "0b775248e6713e3cb99352dc37ec61d5", "ja3_variant_count": 1, "ja3_variants": [ "0b775248e6713e3cb99352dc37ec61d5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_4a513bce9f12_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "4a513bce9f12", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,68-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615158, "transport": "t", "ja3_hash": "1f02cadc916ddb5372bd5cfa045de46e", "ja3_variant_count": 1, "ja3_variants": [ "1f02cadc916ddb5372bd5cfa045de46e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_515ebe86e7c3_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "515ebe86e7c3", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,49-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825522, "last_seen": 1789615163, "transport": "t", "ja3_hash": "970ef19e2ffbd0e6fa62adac27876aa7", "ja3_variant_count": 1, "ja3_variants": [ "970ef19e2ffbd0e6fa62adac27876aa7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_593aba79ccba_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "593aba79ccba", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,18-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615161, "transport": "t", "ja3_hash": "4276ab99d071a9bb565ec7d45d86396b", "ja3_variant_count": 1, "ja3_variants": [ "4276ab99d071a9bb565ec7d45d86396b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_6376cb8fadaa_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "6376cb8fadaa", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,57-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615162, "transport": "t", "ja3_hash": "96bf90f6bee914afb153b4e0352f9192", "ja3_variant_count": 1, "ja3_variants": [ "96bf90f6bee914afb153b4e0352f9192" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_671e0306a5cb_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "671e0306a5cb", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,19-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615157, "transport": "t", "ja3_hash": "f578dcb22423ac294d1ee0298a00c8df", "ja3_variant_count": 1, "ja3_variants": [ "f578dcb22423ac294d1ee0298a00c8df" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_69d181a99895_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "69d181a99895", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,152-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615162, "transport": "t", "ja3_hash": "6cd0a2ffd5bd5f5b4cc48fb43bf26e26", "ja3_variant_count": 1, "ja3_variants": [ "6cd0a2ffd5bd5f5b4cc48fb43bf26e26" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_6d6b3751bd69_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "6d6b3751bd69", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,153-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615161, "transport": "t", "ja3_hash": "137dd98cadc0cccca1b172c2d4da5aae", "ja3_variant_count": 1, "ja3_variants": [ "137dd98cadc0cccca1b172c2d4da5aae" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_72fe80e83b5d_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "72fe80e83b5d", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,13-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825521, "last_seen": 1789615165, "transport": "t", "ja3_hash": "88b839e163b900f7f102c336cb3d1ee2", "ja3_variant_count": 1, "ja3_variants": [ "88b839e163b900f7f102c336cb3d1ee2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_7ba938555a01_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "7ba938555a01", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,25-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615162, "transport": "t", "ja3_hash": "d6d66ce5bd02829baa1456751bc9c2ff", "ja3_variant_count": 1, "ja3_variants": [ "d6d66ce5bd02829baa1456751bc9c2ff" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_85064055552b_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "85064055552b", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,151-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615162, "transport": "t", "ja3_hash": "f6420f0c7e9198ffdd103c3dee5419d0", "ja3_variant_count": 1, "ja3_variants": [ "f6420f0c7e9198ffdd103c3dee5419d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_86ae22adfd52_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "86ae22adfd52", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,52-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615163, "transport": "t", "ja3_hash": "4589064635c084c6d927f588d2dba5d4", "ja3_variant_count": 1, "ja3_variants": [ "4589064635c084c6d927f588d2dba5d4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_8764e5090277_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "8764e5090277", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,135-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615162, "transport": "t", "ja3_hash": "32d03b6a4afeade96c03f01fddbfe457", "ja3_variant_count": 1, "ja3_variants": [ "32d03b6a4afeade96c03f01fddbfe457" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_8cde4933ab6b_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "8cde4933ab6b", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,26-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615160, "transport": "t", "ja3_hash": "9a96daf83235ac19b9754b47fa362e45", "ja3_variant_count": 1, "ja3_variants": [ "9a96daf83235ac19b9754b47fa362e45" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_8d2fb8454607_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "8d2fb8454607", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,70-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825520, "last_seen": 1789615161, "transport": "t", "ja3_hash": "8576125549d965101e9b34bb5b074566", "ja3_variant_count": 1, "ja3_variants": [ "8576125549d965101e9b34bb5b074566" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_9cb11800989c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "9cb11800989c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,155-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825522, "last_seen": 1789615163, "transport": "t", "ja3_hash": "69343daacb932f37db72ea8752939427", "ja3_variant_count": 1, "ja3_variants": [ "69343daacb932f37db72ea8752939427" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_a0f473027383_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "a0f473027383", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,2-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825523, "last_seen": 1789615166, "transport": "t", "ja3_hash": "324dadb77c22c69ea21fc43c4a2d5742", "ja3_variant_count": 1, "ja3_variants": [ "324dadb77c22c69ea21fc43c4a2d5742" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_a5878986a7c9_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "a5878986a7c9", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,47-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615163, "transport": "t", "ja3_hash": "d7ec7d75b7ce78cd8eb846de502a9731", "ja3_variant_count": 1, "ja3_variants": [ "d7ec7d75b7ce78cd8eb846de502a9731" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_a8d286a27066_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "a8d286a27066", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,23-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615162, "transport": "t", "ja3_hash": "c9d9c170168d839d584ee7f695ab1f18", "ja3_variant_count": 1, "ja3_variants": [ "c9d9c170168d839d584ee7f695ab1f18" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_b0ed54973b0f_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "b0ed54973b0f", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,50-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825520, "last_seen": 1789615165, "transport": "t", "ja3_hash": "390b8382cd46a0934ef320bbbed81084", "ja3_variant_count": 1, "ja3_variants": [ "390b8382cd46a0934ef320bbbed81084" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_bae431c474f8_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "bae431c474f8", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,66-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825520, "last_seen": 1789615162, "transport": "t", "ja3_hash": "83da98b99e621c883a2005bbf8aee4c4", "ja3_variant_count": 1, "ja3_variants": [ "83da98b99e621c883a2005bbf8aee4c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_c259c416e32c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "c259c416e32c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,12-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615158, "transport": "t", "ja3_hash": "555b43f780e5455cc174aa5806b8cc8c", "ja3_variant_count": 1, "ja3_variants": [ "555b43f780e5455cc174aa5806b8cc8c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_c38774e7e0a0_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "c38774e7e0a0", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,22-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615161, "transport": "t", "ja3_hash": "62c9d925f44040c29a85ec91b1f3fc6f", "ja3_variant_count": 1, "ja3_variants": [ "62c9d925f44040c29a85ec91b1f3fc6f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_c3df0a865ad8_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "c3df0a865ad8", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,150-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615164, "transport": "t", "ja3_hash": "ed13ef59895b6c10ac255e0dd147f56f", "ja3_variant_count": 1, "ja3_variants": [ "ed13ef59895b6c10ac255e0dd147f56f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_c9fe23a5d87c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "c9fe23a5d87c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,67-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615162, "transport": "t", "ja3_hash": "3eb4e3ab0388351289c62c7faa045a5e", "ja3_variant_count": 1, "ja3_variants": [ "3eb4e3ab0388351289c62c7faa045a5e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_d25758f9cc88_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "d25758f9cc88", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,24-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615160, "transport": "t", "ja3_hash": "7a6711ec0c6f47001f72c0ad413c44e5", "ja3_variant_count": 1, "ja3_variants": [ "7a6711ec0c6f47001f72c0ad413c44e5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_d83d06a7b5eb_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "d83d06a7b5eb", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,134-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825520, "last_seen": 1789615165, "transport": "t", "ja3_hash": "476b5a4716ca2c3fa86fee30d1d0c0fc", "ja3_variant_count": 1, "ja3_variants": [ "476b5a4716ca2c3fa86fee30d1d0c0fc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_d99cf322fdea_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "d99cf322fdea", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,133-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615160, "transport": "t", "ja3_hash": "a94ec3bf0aefbb3d4517277925bb146b", "ja3_variant_count": 1, "ja3_variants": [ "a94ec3bf0aefbb3d4517277925bb146b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_da5e85b893fc_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "da5e85b893fc", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,10-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615162, "transport": "t", "ja3_hash": "6441a2dc314cac5ca3e10c8b04875343", "ja3_variant_count": 1, "ja3_variants": [ "6441a2dc314cac5ca3e10c8b04875343" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_e03107c9d76e_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "e03107c9d76e", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,5-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825520, "last_seen": 1789615164, "transport": "t", "ja3_hash": "02e453705d92b5e55c02fd04616cf914", "ja3_variant_count": 1, "ja3_variants": [ "02e453705d92b5e55c02fd04616cf914" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_e530588400b6_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "e530588400b6", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,132-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825521, "last_seen": 1789615165, "transport": "t", "ja3_hash": "fb25330b1c97c1dec87ee6aaf628da95", "ja3_variant_count": 1, "ja3_variants": [ "fb25330b1c97c1dec87ee6aaf628da95" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_ea1f27bcdcc2_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "ea1f27bcdcc2", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,136-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615158, "transport": "t", "ja3_hash": "e339224df74b79430cef573941a1ae08", "ja3_variant_count": 1, "ja3_variants": [ "e339224df74b79430cef573941a1ae08" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_ed19d00bad77_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "ed19d00bad77", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,21-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615162, "transport": "t", "ja3_hash": "0405e4ba3dc633db829118db06858d17", "ja3_variant_count": 1, "ja3_variants": [ "0405e4ba3dc633db829118db06858d17" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_eea8af79bad9_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "eea8af79bad9", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,69-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825521, "last_seen": 1789615165, "transport": "t", "ja3_hash": "97361fd2be7693286243645d871c6eea", "ja3_variant_count": 1, "ja3_variants": [ "97361fd2be7693286243645d871c6eea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_f2d8273d9564_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "f2d8273d9564", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,53-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615160, "transport": "t", "ja3_hash": "15527e5f7116366575c89314b75bcc97", "ja3_variant_count": 1, "ja3_variants": [ "15527e5f7116366575c89314b75bcc97" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_f4b95c39a23e_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "f4b95c39a23e", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,6-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615161, "transport": "t", "ja3_hash": "2999c52f0834aa567a650c95d32fa29e", "ja3_variant_count": 1, "ja3_variants": [ "2999c52f0834aa567a650c95d32fa29e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_fa20206d2144_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "fa20206d2144", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,7-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825525, "last_seen": 1789615167, "transport": "t", "ja3_hash": "f9d8bc9e0bf72cf4ca925b99bb41f73e", "ja3_variant_count": 1, "ja3_variants": [ "f9d8bc9e0bf72cf4ca925b99bb41f73e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_fbc32bd69299_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "fbc32bd69299", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,8-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615159, "transport": "t", "ja3_hash": "103ee02ec625cfec314c45eb62483094", "ja3_variant_count": 1, "ja3_variants": [ "103ee02ec625cfec314c45eb62483094" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_fd2d85721aa5_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "fd2d85721aa5", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,54-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615158, "transport": "t", "ja3_hash": "e03adae83874dc088f764876e3c1d362", "ja3_variant_count": 1, "ja3_variants": [ "e03adae83874dc088f764876e3c1d362" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_049d0968ef63_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "049d0968ef63", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49174-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615164, "transport": "t", "ja3_hash": "c043373d5acac4d4b4ecf85a53362531", "ja3_variant_count": 1, "ja3_variants": [ "c043373d5acac4d4b4ecf85a53362531" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_0d62a58dd912_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "0d62a58dd912", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49169-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825520, "last_seen": 1789615162, "transport": "t", "ja3_hash": "034295d979b89048bfdc682f626eb2f5", "ja3_variant_count": 1, "ja3_variants": [ "034295d979b89048bfdc682f626eb2f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_2ac205266896_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "2ac205266896", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49173-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825521, "last_seen": 1789615165, "transport": "t", "ja3_hash": "f18cac79fe747500491c6a0735a654f2", "ja3_variant_count": 1, "ja3_variants": [ "f18cac79fe747500491c6a0735a654f2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_48762405b09c_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "48762405b09c", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49157-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615162, "transport": "t", "ja3_hash": "ccf5ed67067dabb97f6b3679ca5cd1c0", "ja3_variant_count": 1, "ja3_variants": [ "ccf5ed67067dabb97f6b3679ca5cd1c0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_4eff32302ec7_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "4eff32302ec7", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49160-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825524, "last_seen": 1789615166, "transport": "t", "ja3_hash": "db7cb9f6bb1d358a8d6f1b28294202fb", "ja3_variant_count": 1, "ja3_variants": [ "db7cb9f6bb1d358a8d6f1b28294202fb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_4f4bd29a6b59_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "4f4bd29a6b59", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49175-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615161, "transport": "t", "ja3_hash": "b6bbf002289d4409e97c61e716148806", "ja3_variant_count": 1, "ja3_variants": [ "b6bbf002289d4409e97c61e716148806" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_55a2bbf9cbd7_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "55a2bbf9cbd7", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49164-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615161, "transport": "t", "ja3_hash": "1ad29174c456c1011a95aea1473ecc20", "ja3_variant_count": 1, "ja3_variants": [ "1ad29174c456c1011a95aea1473ecc20" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_57ba72230e7a_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "57ba72230e7a", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49167-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615162, "transport": "t", "ja3_hash": "d7655d993e9625b52b4e7c3136771e65", "ja3_variant_count": 1, "ja3_variants": [ "d7655d993e9625b52b4e7c3136771e65" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_59980b593f60_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "59980b593f60", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49176-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615160, "transport": "t", "ja3_hash": "09adb7efba899ba62b05660a2d2941d5", "ja3_variant_count": 1, "ja3_variants": [ "09adb7efba899ba62b05660a2d2941d5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_5b44afd80a2d_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "5b44afd80a2d", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49156-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615159, "transport": "t", "ja3_hash": "6099c835887b9fc208bd3e597df78f79", "ja3_variant_count": 1, "ja3_variants": [ "6099c835887b9fc208bd3e597df78f79" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_68cd44b4e773_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "68cd44b4e773", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49162-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825520, "last_seen": 1789615165, "transport": "t", "ja3_hash": "3902a3e31d0cf1497c02b333dd1b4b8c", "ja3_variant_count": 1, "ja3_variants": [ "3902a3e31d0cf1497c02b333dd1b4b8c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_89e01831f9a8_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "89e01831f9a8", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49153-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825522, "last_seen": 1789615164, "transport": "t", "ja3_hash": "d9114dca6a691a912068ad0912a9dab7", "ja3_variant_count": 1, "ja3_variants": [ "d9114dca6a691a912068ad0912a9dab7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_8fc24edd70fe_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "8fc24edd70fe", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49163-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615162, "transport": "t", "ja3_hash": "670e220e2fd76d42249054590b04f050", "ja3_variant_count": 1, "ja3_variants": [ "670e220e2fd76d42249054590b04f050" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_9b38dd297dfe_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "9b38dd297dfe", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49168-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615162, "transport": "t", "ja3_hash": "2d6b844024363110f263a64842c48829", "ja3_variant_count": 1, "ja3_variants": [ "2d6b844024363110f263a64842c48829" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_a0546e0689fc_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "a0546e0689fc", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49171-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615157, "transport": "t", "ja3_hash": "5b1b32c2139f4a8a993de7b8fe1a612e", "ja3_variant_count": 1, "ja3_variants": [ "5b1b32c2139f4a8a993de7b8fe1a612e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_a89416eb2da9_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "a89416eb2da9", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49177-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615162, "transport": "t", "ja3_hash": "d87b695f845df7a2c96d078b9e2d4db3", "ja3_variant_count": 1, "ja3_variants": [ "d87b695f845df7a2c96d078b9e2d4db3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_bad2b1bd13d4_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "bad2b1bd13d4", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49155-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615166, "transport": "t", "ja3_hash": "5242dbe63dac20c841bd3ebcb0301275", "ja3_variant_count": 1, "ja3_variants": [ "5242dbe63dac20c841bd3ebcb0301275" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_c4610a930072_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "c4610a930072", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49159-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615163, "transport": "t", "ja3_hash": "4c5f33c72e436af8fc1a611a5e5e2c1d", "ja3_variant_count": 1, "ja3_variants": [ "4c5f33c72e436af8fc1a611a5e5e2c1d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_c66b7cee1896_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "c66b7cee1896", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49161-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825521, "last_seen": 1789615165, "transport": "t", "ja3_hash": "8c1d9b776226ac1cb18dbc37a3264e8c", "ja3_variant_count": 1, "ja3_variants": [ "8c1d9b776226ac1cb18dbc37a3264e8c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_cc27769a2ea2_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "cc27769a2ea2", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49165-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825521, "last_seen": 1789615163, "transport": "t", "ja3_hash": "2d18a1794435114ef8c15c45810146dc", "ja3_variant_count": 1, "ja3_variants": [ "2d18a1794435114ef8c15c45810146dc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_d0ac5cb1209a_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "d0ac5cb1209a", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49172-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615164, "transport": "t", "ja3_hash": "900a8817a4fad0b220990950b589e4e3", "ja3_variant_count": 1, "ja3_variants": [ "900a8817a4fad0b220990950b589e4e3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_d576ba9a1b51_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "d576ba9a1b51", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49154-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615161, "transport": "t", "ja3_hash": "55ce12fc45791ac16b02ab24b34ca489", "ja3_variant_count": 1, "ja3_variants": [ "55ce12fc45791ac16b02ab24b34ca489" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_efa2d734833b_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "efa2d734833b", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49158-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825521, "last_seen": 1789615164, "transport": "t", "ja3_hash": "bd56a21d0d3609022e969ba4bc8d2885", "ja3_variant_count": 1, "ja3_variants": [ "bd56a21d0d3609022e969ba4bc8d2885" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_f17337cd55b5_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "f17337cd55b5", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49166-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615161, "transport": "t", "ja3_hash": "10d2afb8014c9b6103f1e44d5474a2b7", "ja3_variant_count": 1, "ja3_variants": [ "10d2afb8014c9b6103f1e44d5474a2b7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_f3042cbcf579_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "f3042cbcf579", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49170-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615160, "transport": "t", "ja3_hash": "f32fdd85f37647cb961e99cb39338bb3", "ja3_variant_count": 1, "ja3_variants": [ "f32fdd85f37647cb961e99cb39338bb3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d070700_c50f5591e341_661ff8826348", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d070700", "b": "c50f5591e341", "c": "661ff8826348", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 7, "extension_count": 7, "alpn": null } }, "ja3_string": "770,49162-49161-49172-49171-53-47-10,0-5-10-11-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789450887, "last_seen": 1789450889, "transport": "t", "ja3_hash": "a5fdc0149729da1212fc5714e1d1b928", "ja3_variant_count": 1, "ja3_variants": [ "a5fdc0149729da1212fc5714e1d1b928" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d080700_dafb69683c10_18ee6cfe2d80", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d080700", "b": "dafb69683c10", "c": "18ee6cfe2d80", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 8, "extension_count": 7, "alpn": null } }, "ja3_string": "770,49171-49161-49172-49162-47-53-49170-10,0-5-10-11-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 115, "first_seen": 1787495089, "last_seen": 1789949891, "transport": "t", "ja3_hash": "bf5f7815620bde1949ecc250ec7b3101", "ja3_variant_count": 1, "ja3_variants": [ "bf5f7815620bde1949ecc250ec7b3101" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d090600_c491f621fb4c_80d8baa1f8cb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d090600", "b": "c491f621fb4c", "c": "80d8baa1f8cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 9, "extension_count": 6, "alpn": null } }, "ja3_string": "770,49162-49172-57-49161-49171-51-53-47-255,0-11-10-35-22-23,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 12, "first_seen": 1787697753, "last_seen": 1789425148, "transport": "t", "ja3_hash": "1d41372cac33d51bb9265e8f91bf1df0", "ja3_variant_count": 1, "ja3_variants": [ "1d41372cac33d51bb9265e8f91bf1df0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d110700_3790f16dbcf6_18ee6cfe2d80", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d110700", "b": "3790f16dbcf6", "c": "18ee6cfe2d80", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 11, "extension_count": 7, "alpn": null } }, "ja3_string": "770,10-47-53-49161-49162-49170-49171-49172-5-49159-49169,0-5-10-11-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787969616, "last_seen": 1789792894, "transport": "t", "ja3_hash": "2832c3d8fd7db7c4ae5ffe8fcc768046", "ja3_variant_count": 1, "ja3_variants": [ "2832c3d8fd7db7c4ae5ffe8fcc768046" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d130300_48b83dc3bfb9_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d130300", "b": "48b83dc3bfb9", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 13, "extension_count": 3, "alpn": null } }, "ja3_string": "770,255-49162-49172-57-56-49157-49167-49161-49171-51-50-49156-49166,0-10-11,14-13-25-28-11-12-27-24-9-10-26-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787710533, "last_seen": 1789193077, "transport": "t", "ja3_hash": "12216f2b983b2391ce10bfb973c4367c", "ja3_variant_count": 1, "ja3_variants": [ "12216f2b983b2391ce10bfb973c4367c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d170600_89907b424de5_80d8baa1f8cb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d170600", "b": "89907b424de5", "c": "80d8baa1f8cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 17, "extension_count": 6, "alpn": null } }, "ja3_string": "770,49171-49161-49172-49162-51-56-57-50-47-53-136-135-69-68-132-65-255,0-11-10-35-22-23,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788750552, "last_seen": 1788750552, "transport": "t", "ja3_hash": "1cda5e2b9473f2842c20a9b6fa3c3f8a", "ja3_variant_count": 1, "ja3_variants": [ "1cda5e2b9473f2842c20a9b6fa3c3f8a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d210500_1e0f66cc3f83_5551bc6d1e9a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d210500", "b": "1e0f66cc3f83", "c": "5551bc6d1e9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 21, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49160-57-51-22-4-20-21-8-6-3,0-5-10-11-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 28, "first_seen": 1787464627, "last_seen": 1789868668, "transport": "t", "ja3_hash": "7dad196697fa2c86aabe5422effe4eca", "ja3_variant_count": 1, "ja3_variants": [ "7dad196697fa2c86aabe5422effe4eca" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d320500_5771160a495d_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d320500", "b": "5771160a495d", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 32, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49172-49162-57-56-55-54-49167-49157-53-49171-49161-51-50-49-48-49166-49156-47-154-153-152-151-150-7-49169-49159-49164-49154-5-4-255-22016,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 22016, "name": "22016 (0x5600)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825503, "last_seen": 1789615157, "transport": "t", "ja3_hash": "5c2516aba5bf6d399c313d2b103d9954", "ja3_variant_count": 1, "ja3_variants": [ "5c2516aba5bf6d399c313d2b103d9954" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d420300_4a5d165148b5_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d420300", "b": "4a5d165148b5", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 42, "extension_count": 3, "alpn": null } }, "ja3_string": "770,4-5-10-13-16-19-22-47-48-49-50-51-53-54-55-56-57-65-68-69-102-132-135-136-150-255-49154-49155-49156-49157-49159-49160-49161-49162-49164-49165-49166-49167-49169-49170-49171-49172,0-11-10,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17-29,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787509861, "last_seen": 1789900798, "transport": "t", "ja3_hash": "9ec8baa55c1238cd64f92b0c211432a0", "ja3_variant_count": 1, "ja3_variants": [ "9ec8baa55c1238cd64f92b0c211432a0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d500500_59a6c70126c8_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d500500", "b": "59a6c70126c8", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 50, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49172-49162-57-56-55-54-136-135-134-133-49167-49157-53-132-49171-49161-51-50-49-48-154-153-152-151-69-68-67-66-49166-49156-47-150-65-7-49169-49159-49164-49154-5-4-49170-49160-22-19-16-13-49165-49155-10-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 14, "first_seen": 1788869212, "last_seen": 1789935167, "transport": "t", "ja3_hash": "819e53a1b1502a51c778ca638b1a6a61", "ja3_variant_count": 1, "ja3_variants": [ "819e53a1b1502a51c778ca638b1a6a61" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d6911ht_ea0618708e31_6f77ef117592", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d6911ht", "b": "ea0618708e31", "c": "6f77ef117592", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 69, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "770,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 909, "first_seen": 1787442804, "last_seen": 1789965997, "transport": "t", "ja3_hash": "006315b3ad276906ff11527f9594e5ba", "ja3_variant_count": 1, "ja3_variants": [ "006315b3ad276906ff11527f9594e5ba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i040200_058957366436_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i040200", "b": "058957366436", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 2, "alpn": null } }, "ja3_string": "770,49185-49178-49181-49184,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748805, "last_seen": 1789646812, "transport": "t", "ja3_hash": "395d06a709cf2d62787ce57c0d4c8a66", "ja3_variant_count": 1, "ja3_variants": [ "395d06a709cf2d62787ce57c0d4c8a66" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i040700_cefcabfea53d_28adf769107b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i040700", "b": "cefcabfea53d", "c": "28adf769107b", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 7, "alpn": null } }, "ja3_string": "770,49161-49171-49162-49172,11-65281-23-18-5-10-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 156, "first_seen": 1787448777, "last_seen": 1789950289, "transport": "t", "ja3_hash": "51da711b7d569fac858b548296cc5ca0", "ja3_variant_count": 1, "ja3_variants": [ "51da711b7d569fac858b548296cc5ca0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i080600_dafb69683c10_166ed56ebb15", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i080600", "b": "dafb69683c10", "c": "166ed56ebb15", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 6, "alpn": null } }, "ja3_string": "770,49171-49161-49172-49162-47-53-49170-10,5-10-11-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 104, "first_seen": 1787506162, "last_seen": 1789949650, "transport": "t", "ja3_hash": "bee6b3e6ef3df345dce8323ac55fe31f", "ja3_variant_count": 1, "ja3_variants": [ "bee6b3e6ef3df345dce8323ac55fe31f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i150700_0dfbaf47f5cc_e144c465795a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i150700", "b": "0dfbaf47f5cc", "c": "e144c465795a", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "770,49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-53-47-255,5-10-11-17-23-35-43,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788737393, "last_seen": 1788737393, "transport": "t", "ja3_hash": "94c7e1172dee50f3fa37f53337b1821c", "ja3_variant_count": 1, "ja3_variants": [ "94c7e1172dee50f3fa37f53337b1821c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i200800_0bf03fa604e3_fe2522846a15", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i200800", "b": "0bf03fa604e3", "c": "fe2522846a15", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 8, "alpn": null } }, "ja3_string": "770,49162-49172-57-107-53-61-49159-49161-49187-49169-49171-49191-51-103-50-5-4-47-60-10,61184-65281-10-11-35-13172-30031-5,23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 61184, "name": "61184 (0xef00)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 30031, "name": "30031 (0x754f)", "known": false }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787538284, "last_seen": 1789960993, "transport": "t", "ja3_hash": "18e9afaf91db6f8a2470e7435c2a1d6b", "ja3_variant_count": 1, "ja3_variants": [ "18e9afaf91db6f8a2470e7435c2a1d6b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_13a2a23d501b_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "13a2a23d501b", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182-49185-49178-49181-49184,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787820549, "last_seen": 1789027743, "transport": "t", "ja3_hash": "358dcfa8315581a920432fa371d4f75f", "ja3_variant_count": 1, "ja3_variants": [ "358dcfa8315581a920432fa371d4f75f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_1715b94e3896_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "1715b94e3896", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,98-97-96-100-8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748804, "last_seen": 1789646812, "transport": "t", "ja3_hash": "97576419ccffed20d01f7ea996805a0e", "ja3_variant_count": 1, "ja3_variants": [ "97576419ccffed20d01f7ea996805a0e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_1e98fdfb27e9_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "1e98fdfb27e9", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49411-49413-49409-49412-49414-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748807, "last_seen": 1789646814, "transport": "t", "ja3_hash": "7cd4f082091773003500e04573b13cc3", "ja3_variant_count": 1, "ja3_variants": [ "7cd4f082091773003500e04573b13cc3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_67f0ca237a44_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "67f0ca237a44", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138-98-97-96-100,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787820545, "last_seen": 1789027739, "transport": "t", "ja3_hash": "4cf905cd9c0c9726be4039ee4fa7dbfd", "ja3_variant_count": 1, "ja3_variants": [ "4cf905cd9c0c9726be4039ee4fa7dbfd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_a3acda31d846_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "a3acda31d846", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787820548, "last_seen": 1789646814, "transport": "t", "ja3_hash": "fd449c76cf71d3dc70c71c19bd0cfccf", "ja3_variant_count": 2, "ja3_variants": [ "fd449c76cf71d3dc70c71c19bd0cfccf", "92a5a0cbf6c197caf78ddd535bdaabc6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_e31a90cd0803_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "e31a90cd0803", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787820544, "last_seen": 1789646813, "transport": "t", "ja3_hash": "0eaa05ee342d9089e87b771465ead0ae", "ja3_variant_count": 2, "ja3_variants": [ "0eaa05ee342d9089e87b771465ead0ae", "f44c27ddb35bd3a6effa634189bc02d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_e7b476f9520b_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "e7b476f9520b", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787820543, "last_seen": 1789646810, "transport": "t", "ja3_hash": "41cf7ae575059d6f9a98b3de95c71539", "ja3_variant_count": 2, "ja3_variants": [ "41cf7ae575059d6f9a98b3de95c71539", "7e65b148cca26a2244514e19d228d77c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_f559eb9565fd_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "f559eb9565fd", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787820549, "last_seen": 1789646811, "transport": "t", "ja3_hash": "46ab3b3aea531a6e66f5685c5243fd37", "ja3_variant_count": 2, "ja3_variants": [ "46ab3b3aea531a6e66f5685c5243fd37", "9ef6c95521c2ab5006c236ff0047fab1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i990200_0df3f6915705_357e3bc58f3d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i990200", "b": "0df3f6915705", "c": "357e3bc58f3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 99, "extension_count": 2, "alpn": null } }, "ja3_string": "770,160-49261-49180-49185-49163-49268-49241-52394-136-49250-49325-49158-187-74-193-54-64-52244-49207-49168-143-49201-50-49279-49331-49297-52393-179-171-49232-66-49304-53253-49217-76-71-49234-49175-4870-81-84-163-49211-49249-147-49170-172-49258-68-104-49294-49266-146-70-49323-49319-65278-181-51-77-29-49300-61-34-49312-124-192-116-75-52398-167-49194-197-53-57-49332-46-180-49155-17-96-186-49246-12-40-49166-196-15-97-131-5-49282-128-28-170-49212-198-119-52395-1-157-152-98-4867-49156-103-4871-49172-49293-72-10-69-88-49231-145-20-49202-49193-49313-49154-4869-38-4868-41-49269-49308-4866-4865-65279-156-49190-49326-49411-178-49314-52243-49272-190-49216-120-32-92-43-100-125-52396-52392-49265-105-52245-49287-53250-49414-49248-141-44-49157-49165-11-35-4-49410-59-114-49408-49333-49330-151-139-49329-86-89-49327-49324-49299-49184-49233-49320-49206-49153-49292-27-49225-49316-49315-53251-49311-49310-49309-49209-49223-49239-49177-176-49247-37-49220-24-33-49303-49295-73-49281-49291-49301-49298-45-49296-47-18-164-49317-49290-49289-140-49288-7-49286-49285-49284-188-49221-49198-121-49302-49280-49208-9-49277-182-62-22-52-49178-101-49271-183-26-49276-49275-49274-177-132-53249-49187-49270-60-49267-49328-56-135-49260-49171-78-49259-49252-49173-49219-189-14-55-49255-49254-49253-49161-49305-30-49245-49244-49256-79-90-162-49262-2-166-49307-49238-49237-129-49236-49167-80-49321-49230-49229-49228-49227-23-49226-102-49222-49224-42-126-6-150-49218-138-49243-49-83-169-63-49210-49192-49278-49215-49204-49203-49191-49200-49199-49197-8-142-49162-49196-0-49264-168-161-49188-19-39-165-49322-49183-49182-49181-3-49179-108-49176-191-49174-49257-25-49169-49235-49412-49164-115-49251-49160-49159-199-87-154-134-65-58-16-49318-49240-148-194-52397-49214-13-155-158-149-21-49283-185-85-49273-49306-175-48-91-49413-173-153-49189-49186-49242-159-144-174-49205-137-31-195-49213-130-109-107-49195-99-106-184-133-82-36-67-49409-49263,10-15,23-24-25-29-256-4588,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 4870, "name": "4870 (0x1306)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4871, "name": "4871 (0x1307)", "known": false }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1788737426, "last_seen": 1789364935, "transport": "t", "ja3_hash": "923044aeda9e16eabbb44bc3bb1073d3", "ja3_variant_count": 5, "ja3_variants": [ "923044aeda9e16eabbb44bc3bb1073d3", "58dced644ea9e4e51cbc9cfc7b366aa4", "9188d6c1670d0ad22dbc300e3ff4a70d", "b5699e73c695bcd17f852491c3b6be92", "07cc6180324d1cefb803ebcf40382fb3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d060400_272d6f91cd02_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d060400", "b": "272d6f91cd02", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 6, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49179-49182-49185-49178-49181-49184,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710050, "last_seen": 1788842300, "transport": "t", "ja3_hash": "b9dcb8b7cad8f18737663d236068d285", "ja3_variant_count": 4, "ja3_variants": [ "b9dcb8b7cad8f18737663d236068d285", "f1e69f2ace5cf1f2ada9a07fccc545b7", "d554c462404afbfb1665a652ae168077", "f264a1120dffe2e9c1652ab24cdf0578" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d150300_8daaf6152771_470e2cdabb19", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "470e2cdabb19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789862597, "last_seen": 1789862597, "transport": "t", "ja3_hash": "b9ebf51c0b3a54c05672e8c7b3afd1c4", "ja3_variant_count": 1, "ja3_variants": [ "b9ebf51c0b3a54c05672e8c7b3afd1c4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_4e0b33d966cb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "4e0b33d966cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-11-23-0-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789526921, "last_seen": 1789526921, "transport": "t", "ja3_hash": "923634a4eb2b82fb7243a08df62376eb", "ja3_variant_count": 1, "ja3_variants": [ "923634a4eb2b82fb7243a08df62376eb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_3dff13c980b9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "3dff13c980b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-23-11-65281-16-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788962454, "last_seen": 1788962454, "transport": "t", "ja3_hash": "b9eb9353c8d14a7767d0a218f89d6311", "ja3_variant_count": 1, "ja3_variants": [ "b9eb9353c8d14a7767d0a218f89d6311" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_55c16fca920c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "55c16fca920c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-17613-0-65281-23-27-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788516988, "last_seen": 1788516988, "transport": "t", "ja3_hash": "c8b1189c1b852963a6f2361f95da9c47", "ja3_variant_count": 1, "ja3_variants": [ "c8b1189c1b852963a6f2361f95da9c47" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_fd15b84c3250", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "fd15b84c3250", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-65037-35-11-10-17613-65281-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789949063, "last_seen": 1789949063, "transport": "t", "ja3_hash": "83f5e6d3c02acc2831ef192e7e6ab0d8", "ja3_variant_count": 1, "ja3_variants": [ "83f5e6d3c02acc2831ef192e7e6ab0d8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_40cda8dfb402", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "40cda8dfb402", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-11-5-0-17613-16-65281-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789949158, "last_seen": 1789949158, "transport": "t", "ja3_hash": "d1dcefe0c49d58f2c3b95b5ab15cc549", "ja3_variant_count": 1, "ja3_variants": [ "d1dcefe0c49d58f2c3b95b5ab15cc549" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_1db44c5aa782", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "1db44c5aa782", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-13-5-11-17613-10-65281-65037-16-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789949108, "last_seen": 1789949108, "transport": "t", "ja3_hash": "4346b28db0dca52137a4819114712c0a", "ja3_variant_count": 1, "ja3_variants": [ "4346b28db0dca52137a4819114712c0a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_564d7693bc92", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "564d7693bc92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-27-65281-0-35-16-45-18-17613-5-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789950117, "last_seen": 1789950117, "transport": "t", "ja3_hash": "669a60a3e6ce36cf3bdc7c7bc3759c2e", "ja3_variant_count": 1, "ja3_variants": [ "669a60a3e6ce36cf3bdc7c7bc3759c2e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_b302c6cb872d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "b302c6cb872d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-18-23-5-11-35-45-65037-27-17613-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789232386, "last_seen": 1789232386, "transport": "t", "ja3_hash": "b5bc3cd0623ac15d4d4300485ea360ea", "ja3_variant_count": 1, "ja3_variants": [ "b5bc3cd0623ac15d4d4300485ea360ea" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d3411ht_a634f799a498_6f77ef117592", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (6f77ef117592) with 1 fingerprint classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d3411ht", "b": "a634f799a498", "c": "6f77ef117592", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 34, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 910, "first_seen": 1787442801, "last_seen": 1789965997, "transport": "t", "ja3_hash": "a96dc3876784813c57d302241e620acd", "ja3_variant_count": 1, "ja3_variants": [ "a96dc3876784813c57d302241e620acd" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d3511ht_66c735deec94_6f77ef117592", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (6f77ef117592) with 1 fingerprint classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d3511ht", "b": "66c735deec94", "c": "6f77ef117592", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 35, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,49170-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 911, "first_seen": 1787442802, "last_seen": 1789965997, "transport": "t", "ja3_hash": "03a3ad27040f733ee5c9915e0903d028", "ja3_variant_count": 1, "ja3_variants": [ "03a3ad27040f733ee5c9915e0903d028" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d630400_305e7cc661dc_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d630400", "b": "305e7cc661dc", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 63, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49175-90-49176-49177-89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710051, "last_seen": 1788842301, "transport": "t", "ja3_hash": "9bb386a183416189b8cce1d5b0a3f371", "ja3_variant_count": 4, "ja3_variants": [ "9bb386a183416189b8cce1d5b0a3f371", "d41cdd80cbce4c05a0392a7bc1111e2b", "b761c1e7a49b5759fbfd883ccc7a29ed", "9744b8410a984bb2c44adc61178636fd" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d630400_4607ee80f03a_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d630400", "b": "4607ee80f03a", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 63, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49171-49191-49199-49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710051, "last_seen": 1788842300, "transport": "t", "ja3_hash": "4eb082201fa9c1eecbfec725fcfa1f5c", "ja3_variant_count": 4, "ja3_variants": [ "4eb082201fa9c1eecbfec725fcfa1f5c", "8964ee2e3e1f67db2db3c8d0dbf18ba7", "4db1cb52854e0d2a6a6a51407b182df9", "b929451b3e8eeb88c2628fd942838a1f" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d630400_6ea97102b799_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d630400", "b": "6ea97102b799", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 63, "extension_count": 4, "alpn": null } }, "ja3_string": "771,107-49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710046, "last_seen": 1788842296, "transport": "t", "ja3_hash": "937982361e499ecaa781355b80b822d0", "ja3_variant_count": 4, "ja3_variants": [ "937982361e499ecaa781355b80b822d0", "ef420e4cd4a429fe85fb06451e12369f", "c6bd78815c87e6370994c16e44075802", "0800d5d1e525fa7dc0de507e6c873879" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d630400_a819cc8c6927_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d630400", "b": "a819cc8c6927", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 63, "extension_count": 4, "alpn": null } }, "ja3_string": "771,166-58-109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710045, "last_seen": 1788842294, "transport": "t", "ja3_hash": "623371194c33f6222f0054f2e01ee456", "ja3_variant_count": 4, "ja3_variants": [ "623371194c33f6222f0054f2e01ee456", "41264a871d84b4e246c1db8ac053ec1b", "d76f5b1e29263560cf11bd4d5fffd466", "a0c89d515d20f1b2a1f667b0be6ea7c4" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d630400_c47ce3b2bf1f_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d630400", "b": "c47ce3b2bf1f", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 63, "extension_count": 4, "alpn": null } }, "ja3_string": "771,138-98-97-96-100-8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710050, "last_seen": 1788842300, "transport": "t", "ja3_hash": "e63c9d292bf6229c99b26173d57ebc1a", "ja3_variant_count": 4, "ja3_variants": [ "e63c9d292bf6229c99b26173d57ebc1a", "fb5039ae26079f961dd2e371f319455f", "66096e085f746187a4758c8f7ebb16d7", "38f53ffbd432ad21db3453dfb600f0f6" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d630400_f4a33ce78bd4_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d630400", "b": "f4a33ce78bd4", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 63, "extension_count": 4, "alpn": null } }, "ja3_string": "771,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710049, "last_seen": 1788842298, "transport": "t", "ja3_hash": "c0b5c70aded5de1c99d422ff06236d99", "ja3_variant_count": 4, "ja3_variants": [ "c0b5c70aded5de1c99d422ff06236d99", "4aa90cde4c98e4c0164c352aa434849f", "e2ec31eb1cc52c0477adfdf955d280a8", "449c2bf4be38263ae55eb22ffba37c11" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d6911hq_ea0618708e31_6f77ef117592", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (6f77ef117592) with 1 fingerprint classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d6911hq", "b": "ea0618708e31", "c": "6f77ef117592", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 69, "extension_count": 11, "alpn": "hq" } }, "ja3_string": "771,49170-49171-49159-49191-52244-49199-4865-49172-4866-49192-52393-49200-49267-49248-49266-49249-49196-49270-49327-49271-49325-52392-49188-4869-49162-4868-49195-4867-49326-52243-49324-49169-49187-10-49161-47-49160-60-154-49308-196-49312-136-156-190-53-69-61-159-49309-49315-49313-49311-157-107-65-57-186-158-132-49314-192-49310-7-103-4-51-5-22,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 909, "first_seen": 1787442802, "last_seen": 1789965997, "transport": "t", "ja3_hash": "1289771a3fce256d5fb4cb5c95b43ee6", "ja3_variant_count": 2, "ja3_variants": [ "1289771a3fce256d5fb4cb5c95b43ee6", "66d4597f171299d13a534dc61e7b931a" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12i030700_8b6334b1051c_ac8bd4dd6c01", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i030700", "b": "8b6334b1051c", "c": "ac8bd4dd6c01", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 7, "alpn": null } }, "ja3_string": "771,3-6-8,5-10-11-13-65281-15-18,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 30, "first_seen": 1787469655, "last_seen": 1789965855, "transport": "t", "ja3_hash": "22aa2bdb630c59d5ff64a34017e418c4", "ja3_variant_count": 1, "ja3_variants": [ "22aa2bdb630c59d5ff64a34017e418c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i040300_058957366436_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i040300", "b": "058957366436", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 3, "alpn": null } }, "ja3_string": "771,49185-49178-49181-49184,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748810, "last_seen": 1789646816, "transport": "t", "ja3_hash": "575fec939ada7e5d00cc1ba626fdbd43", "ja3_variant_count": 1, "ja3_variants": [ "575fec939ada7e5d00cc1ba626fdbd43" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i040900_847a4004cbf9_a92c7c6a82fe", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i040900", "b": "847a4004cbf9", "c": "a92c7c6a82fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49196-49161-49162,11-65281-23-18-5-10-13-50-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 155, "first_seen": 1787448777, "last_seen": 1789950290, "transport": "t", "ja3_hash": "387fec6871738fb5adb3695ca1503040", "ja3_variant_count": 1, "ja3_variants": [ "387fec6871738fb5adb3695ca1503040" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i050100_7f27215065b1_e5744cedd59f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i050100", "b": "7f27215065b1", "c": "e5744cedd59f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 5, "extension_count": 1, "alpn": null } }, "ja3_string": "771,47-10-19-57-4,13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1787911806, "last_seen": 1789142259, "transport": "t", "ja3_hash": "0936656793efc6870927862aa11c885c", "ja3_variant_count": 1, "ja3_variants": [ "0936656793efc6870927862aa11c885c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i050300_d8ff220ab85b_beb9f91c6f80", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i050300", "b": "d8ff220ab85b", "c": "beb9f91c6f80", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 5, "extension_count": 3, "alpn": null } }, "ja3_string": "771,52393-49195-52392-49199-156,43-10-13,29-23,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [] }, "observed": { "count": 64, "first_seen": 1787497739, "last_seen": 1789961362, "transport": "t", "ja3_hash": "7ed05806f66476ade54c4abcdb6f1939", "ja3_variant_count": 1, "ja3_variants": [ "7ed05806f66476ade54c4abcdb6f1939" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i050400_34c2dc17cea7_f0b8f5931c7e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i050400", "b": "34c2dc17cea7", "c": "f0b8f5931c7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 5, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49195-49199-49171-156-47,10-11-13-65281,23-1-3-19-21-6-7-9-10-24-11-12-25-13-14-15-16-17-2-18-4-5-20-8-22,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789794011, "last_seen": 1789794011, "transport": "t", "ja3_hash": "1731f90b609463a8e73ef8f75d32174b", "ja3_variant_count": 1, "ja3_variants": [ "1731f90b609463a8e73ef8f75d32174b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i060100_eca7c5d91837_338aad02a631", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i060100", "b": "eca7c5d91837", "c": "338aad02a631", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 6, "extension_count": 1, "alpn": null } }, "ja3_string": "771,47-10-19-57-4-255,13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789093650, "last_seen": 1789285850, "transport": "t", "ja3_hash": "16ee84a07b55074cb2751329bf1c8811", "ja3_variant_count": 1, "ja3_variants": [ "16ee84a07b55074cb2751329bf1c8811" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i080300_30ad22c17fce_15cf763851c4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i080300", "b": "30ad22c17fce", "c": "15cf763851c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 3, "alpn": null } }, "ja3_string": "771,20-17-25-8-6-23-3-255,35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788685059, "last_seen": 1789264660, "transport": "t", "ja3_hash": "865e4305a503dc51f83a3c6b6da9fdcf", "ja3_variant_count": 1, "ja3_variants": [ "865e4305a503dc51f83a3c6b6da9fdcf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i080600_0df93f53a2f9_f28add8e7af0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i080600", "b": "0df93f53a2f9", "c": "f28add8e7af0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191,10-11-13-35-23-65281,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789854964, "last_seen": 1789854964, "transport": "t", "ja3_hash": "947ab578710446df401f3391adcd5357", "ja3_variant_count": 1, "ja3_variants": [ "947ab578710446df401f3391adcd5357" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i080900_a5784322a9f4_a92c7c6a82fe", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i080900", "b": "a5784322a9f4", "c": "a92c7c6a82fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49199-49200-49171-49172-156-157-47-53,11-65281-23-18-5-10-13-50-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 159, "first_seen": 1787448773, "last_seen": 1789950289, "transport": "t", "ja3_hash": "08457f913bb93e139bca198696428c81", "ja3_variant_count": 1, "ja3_variants": [ "08457f913bb93e139bca198696428c81" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i130300_8b80da21ef18_269b5d1fb7c0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i130300", "b": "8b80da21ef18", "c": "269b5d1fb7c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 3, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,10-11-13,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 13, "first_seen": 1787646642, "last_seen": 1788932598, "transport": "t", "ja3_hash": "b881b92274f99205ebee7e9bdc064408", "ja3_variant_count": 1, "ja3_variants": [ "b881b92274f99205ebee7e9bdc064408" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i130500_2d7513195f68_e51b7354d87f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i130500", "b": "2d7513195f68", "c": "e51b7354d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1543, "first_seen": 1787443523, "last_seen": 1789966974, "transport": "t", "ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "ja3_variant_count": 1, "ja3_variants": [ "cba7f34191ef2379c1325641f6c6c4f4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i130700_2d7513195f68_ac8bd4dd6c01", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i130700", "b": "2d7513195f68", "c": "ac8bd4dd6c01", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281-15-18,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788293169, "last_seen": 1789261984, "transport": "t", "ja3_hash": "caaddd3ed0a315543d761490b01b08e0", "ja3_variant_count": 1, "ja3_variants": [ "caaddd3ed0a315543d761490b01b08e0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150100_8daaf6152771_6d763631da8d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150100", "b": "8daaf6152771", "c": "6d763631da8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 1, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789744600, "last_seen": 1789744600, "transport": "t", "ja3_hash": "d635d6b6a816ae0847dde566ef068589", "ja3_variant_count": 1, "ja3_variants": [ "d635d6b6a816ae0847dde566ef068589" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_dc539c0f9221", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "dc539c0f9221", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789694717, "last_seen": 1789694717, "transport": "t", "ja3_hash": "54c7408ec6a15741873e5f8cc5105053", "ja3_variant_count": 1, "ja3_variants": [ "54c7408ec6a15741873e5f8cc5105053" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_053cb7d49935", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "053cb7d49935", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788454621, "last_seen": 1789829918, "transport": "t", "ja3_hash": "538f74c69e1fde2d77bfe6311555dfd0", "ja3_variant_count": 1, "ja3_variants": [ "538f74c69e1fde2d77bfe6311555dfd0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_179c2294c086", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "179c2294c086", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788900220, "last_seen": 1788900220, "transport": "t", "ja3_hash": "88ccd2b0780749507e98edb7b176be9e", "ja3_variant_count": 1, "ja3_variants": [ "88ccd2b0780749507e98edb7b176be9e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_43d44e58c561", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "43d44e58c561", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788454621, "last_seen": 1788454621, "transport": "t", "ja3_hash": "c566cadecd5a212b723054f3d1d1438a", "ja3_variant_count": 1, "ja3_variants": [ "c566cadecd5a212b723054f3d1d1438a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_46bea0c559da", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "46bea0c559da", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789813437, "last_seen": 1789813437, "transport": "t", "ja3_hash": "8fc0daab40d2bb09858ecb58b557fbf9", "ja3_variant_count": 1, "ja3_variants": [ "8fc0daab40d2bb09858ecb58b557fbf9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_470e2cdabb19", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "470e2cdabb19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789007207, "last_seen": 1789007207, "transport": "t", "ja3_hash": "808f929c0df0c56f724f1caa3cdf071b", "ja3_variant_count": 1, "ja3_variants": [ "808f929c0df0c56f724f1caa3cdf071b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_5983db0d0827", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "5983db0d0827", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789296239, "last_seen": 1789296239, "transport": "t", "ja3_hash": "f327af3f363f0e559ce60e4fbf6928a6", "ja3_variant_count": 1, "ja3_variants": [ "f327af3f363f0e559ce60e4fbf6928a6" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 8 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_5a5c3e855d18", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "5a5c3e855d18", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789005257, "last_seen": 1789026667, "transport": "t", "ja3_hash": "ee7aa23c71d242c9a6d4770824c3ce5b", "ja3_variant_count": 1, "ja3_variants": [ "ee7aa23c71d242c9a6d4770824c3ce5b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": true } }, { "hash": "t12i150300_8daaf6152771_6297b054c2bd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "6297b054c2bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839901, "last_seen": 1788839901, "transport": "t", "ja3_hash": "15bf8c03dc730cb4f89d79e456b31d9b", "ja3_variant_count": 1, "ja3_variants": [ "15bf8c03dc730cb4f89d79e456b31d9b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_6aa674dfc862", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "6aa674dfc862", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789112205, "last_seen": 1789112205, "transport": "t", "ja3_hash": "6766b026e3784338edf635dbb00b0ab1", "ja3_variant_count": 1, "ja3_variants": [ "6766b026e3784338edf635dbb00b0ab1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_757efd7250b5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "757efd7250b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789218776, "last_seen": 1789218776, "transport": "t", "ja3_hash": "06d52c2323f627da8d3805a9f95b474d", "ja3_variant_count": 1, "ja3_variants": [ "06d52c2323f627da8d3805a9f95b474d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_8af5f994aba1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "8af5f994aba1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788471552, "last_seen": 1788471552, "transport": "t", "ja3_hash": "12fd83710fc8a062bd8a3be597f516e6", "ja3_variant_count": 1, "ja3_variants": [ "12fd83710fc8a062bd8a3be597f516e6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_952aae1a8b47", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "952aae1a8b47", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789754547, "last_seen": 1789838665, "transport": "t", "ja3_hash": "3a9a1ea9b06a1ccc927c51e9c6e0d452", "ja3_variant_count": 2, "ja3_variants": [ "3a9a1ea9b06a1ccc927c51e9c6e0d452", "27ced869b50ce071227d2643300e59d7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_95b8518dd442", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "95b8518dd442", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788777964, "last_seen": 1788777964, "transport": "t", "ja3_hash": "a801c86bf8101a0e948d1d13a526b271", "ja3_variant_count": 1, "ja3_variants": [ "a801c86bf8101a0e948d1d13a526b271" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_9c8a4aba36de", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "9c8a4aba36de", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788848239, "last_seen": 1788848239, "transport": "t", "ja3_hash": "cfb1f1afb69d84632dc5583618cfd373", "ja3_variant_count": 1, "ja3_variants": [ "cfb1f1afb69d84632dc5583618cfd373" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_db16c25f22ee", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "db16c25f22ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789007209, "last_seen": 1789007209, "transport": "t", "ja3_hash": "c2216a9ed9599867698b065681ca977b", "ja3_variant_count": 1, "ja3_variants": [ "c2216a9ed9599867698b065681ca977b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_de7c87d72c1a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "de7c87d72c1a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789754550, "last_seen": 1789754550, "transport": "t", "ja3_hash": "cb903e77752bea3813ca5129fb32cc7c", "ja3_variant_count": 1, "ja3_variants": [ "cb903e77752bea3813ca5129fb32cc7c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_01a6f240da47", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "01a6f240da47", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789196276, "last_seen": 1789196276, "transport": "t", "ja3_hash": "d0f48810059faa61abec65aee0eccf69", "ja3_variant_count": 1, "ja3_variants": [ "d0f48810059faa61abec65aee0eccf69" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_0cae308ccb88", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "0cae308ccb88", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788530074, "last_seen": 1788530074, "transport": "t", "ja3_hash": "56370782ea98e6be6f03006aa9f80f3c", "ja3_variant_count": 1, "ja3_variants": [ "56370782ea98e6be6f03006aa9f80f3c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_22a5c3089bb0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "22a5c3089bb0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-18-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788777784, "last_seen": 1788777784, "transport": "t", "ja3_hash": "57cf62be24accabaa6df75ccdce29e8b", "ja3_variant_count": 1, "ja3_variants": [ "57cf62be24accabaa6df75ccdce29e8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_352cb4ed7051", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "352cb4ed7051", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788448269, "last_seen": 1788448269, "transport": "t", "ja3_hash": "000da169b6d97fc3a93b15fc4cc7e59a", "ja3_variant_count": 1, "ja3_variants": [ "000da169b6d97fc3a93b15fc4cc7e59a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_3dfec539bd98", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "3dfec539bd98", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-10-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730572, "last_seen": 1789730572, "transport": "t", "ja3_hash": "ed2d503dafc4416d0c037cd76bf7a34b", "ja3_variant_count": 1, "ja3_variants": [ "ed2d503dafc4416d0c037cd76bf7a34b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_409524cce7c5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "409524cce7c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-5-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788899786, "last_seen": 1788899786, "transport": "t", "ja3_hash": "cb67c017c1167063538e890732602577", "ja3_variant_count": 1, "ja3_variants": [ "cb67c017c1167063538e890732602577" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_44b630b257ba", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "44b630b257ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789391197, "last_seen": 1789391197, "transport": "t", "ja3_hash": "ef12c166b28aa738cac07ccdde0ced61", "ja3_variant_count": 1, "ja3_variants": [ "ef12c166b28aa738cac07ccdde0ced61" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_47e60eb062aa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "47e60eb062aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-23-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788454690, "last_seen": 1788454690, "transport": "t", "ja3_hash": "17ceab730f66caadd8d7b26f4a789e27", "ja3_variant_count": 1, "ja3_variants": [ "17ceab730f66caadd8d7b26f4a789e27" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_483d8b530527", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "483d8b530527", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-65281-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789820711, "last_seen": 1789820711, "transport": "t", "ja3_hash": "5fb25e37bb35b14fce08d749c69ac4cc", "ja3_variant_count": 1, "ja3_variants": [ "5fb25e37bb35b14fce08d749c69ac4cc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_66b4109d398c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "66b4109d398c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788932608, "last_seen": 1788932608, "transport": "t", "ja3_hash": "ff9720c3847bc0ac95e59bc316364cbc", "ja3_variant_count": 1, "ja3_variants": [ "ff9720c3847bc0ac95e59bc316364cbc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_66bc1639a017", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "66bc1639a017", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788448266, "last_seen": 1788448266, "transport": "t", "ja3_hash": "140a4c1a3717105d58a44204a631edeb", "ja3_variant_count": 1, "ja3_variants": [ "140a4c1a3717105d58a44204a631edeb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_7defff518584", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "7defff518584", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789445001, "last_seen": 1789445001, "transport": "t", "ja3_hash": "c970eadb029304dfe3063de36878d3af", "ja3_variant_count": 1, "ja3_variants": [ "c970eadb029304dfe3063de36878d3af" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_7e6ef838d0a2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "7e6ef838d0a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789701012, "last_seen": 1789701012, "transport": "t", "ja3_hash": "2c625136f763b1cb0ce0d2c77855c3bd", "ja3_variant_count": 1, "ja3_variants": [ "2c625136f763b1cb0ce0d2c77855c3bd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_95460fc905c4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "95460fc905c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51-17613-23,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788448168, "last_seen": 1788448168, "transport": "t", "ja3_hash": "1a827c12b4708b127e29c6426d24889c", "ja3_variant_count": 1, "ja3_variants": [ "1a827c12b4708b127e29c6426d24889c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a3e22a03c307", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a3e22a03c307", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-4832-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789587739, "last_seen": 1789587739, "transport": "t", "ja3_hash": "9407b52719784e6908b3ff3861b9fe01", "ja3_variant_count": 1, "ja3_variants": [ "9407b52719784e6908b3ff3861b9fe01" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a9aef3f04aaf", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a9aef3f04aaf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789202032, "last_seen": 1789202032, "transport": "t", "ja3_hash": "5d68eb132bc279941e2cd7673e36d848", "ja3_variant_count": 1, "ja3_variants": [ "5d68eb132bc279941e2cd7673e36d848" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b623d8bb4e99", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b623d8bb4e99", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789063166, "last_seen": 1789063166, "transport": "t", "ja3_hash": "ebb0b0bc62fff6f1d394c34b8dd14645", "ja3_variant_count": 1, "ja3_variants": [ "ebb0b0bc62fff6f1d394c34b8dd14645" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b711ee288075", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b711ee288075", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789595724, "last_seen": 1789595724, "transport": "t", "ja3_hash": "d079d69ac933561524ad9237073a776a", "ja3_variant_count": 1, "ja3_variants": [ "d079d69ac933561524ad9237073a776a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_c427bfe75be1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "c427bfe75be1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51764-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788454689, "last_seen": 1788454689, "transport": "t", "ja3_hash": "2448afc9f5238283cb18616b5f4def8b", "ja3_variant_count": 1, "ja3_variants": [ "2448afc9f5238283cb18616b5f4def8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_ea4cde416e08", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "ea4cde416e08", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-10-51764,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730577, "last_seen": 1789730577, "transport": "t", "ja3_hash": "d91360d0e457f5df362cc01a6dc5a35d", "ja3_variant_count": 1, "ja3_variants": [ "d91360d0e457f5df362cc01a6dc5a35d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_7bd54d6701ef_110b9cfecf33", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "7bd54d6701ef", "c": "110b9cfecf33", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,52393-52392-49196-49195-49200-49199-157-156-49162-49161-49171-49170-53-47-10,43-10-13-23-65281,25-24-23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 63, "first_seen": 1787497838, "last_seen": 1789961361, "transport": "t", "ja3_hash": "94b830560a8d5ef6b05cd569c9a38a9e", "ja3_variant_count": 1, "ja3_variants": [ "94b830560a8d5ef6b05cd569c9a38a9e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_116ba12e1f7f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "116ba12e1f7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-13-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788776671, "last_seen": 1788776671, "transport": "t", "ja3_hash": "be8d0bf060f8bc61bb8cb9fcb8864420", "ja3_variant_count": 1, "ja3_variants": [ "be8d0bf060f8bc61bb8cb9fcb8864420" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_19615b360095", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "19615b360095", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789375385, "last_seen": 1789375385, "transport": "t", "ja3_hash": "ec85f60e24c37602c9961d2b6a494e2b", "ja3_variant_count": 1, "ja3_variants": [ "ec85f60e24c37602c9961d2b6a494e2b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_1bcb1ee50776", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "1bcb1ee50776", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-27-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789865337, "last_seen": 1789865337, "transport": "t", "ja3_hash": "4df60df3422655bb22de295dcb52bf92", "ja3_variant_count": 1, "ja3_variants": [ "4df60df3422655bb22de295dcb52bf92" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_23ba83f97f66", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "23ba83f97f66", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-35-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789226269, "last_seen": 1789226269, "transport": "t", "ja3_hash": "44e5dd58e48e4b6da860e587175478ba", "ja3_variant_count": 1, "ja3_variants": [ "44e5dd58e48e4b6da860e587175478ba" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_2ae2e10a93e2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "2ae2e10a93e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-35-17613-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788899784, "last_seen": 1788899784, "transport": "t", "ja3_hash": "9a94f6f47c708acbe1f8d4aeb1fffedd", "ja3_variant_count": 1, "ja3_variants": [ "9a94f6f47c708acbe1f8d4aeb1fffedd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_2d0ccb55ba04", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "2d0ccb55ba04", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789929467, "last_seen": 1789929467, "transport": "t", "ja3_hash": "043a8def104e9f55d80c38608ea2ee2a", "ja3_variant_count": 1, "ja3_variants": [ "043a8def104e9f55d80c38608ea2ee2a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_31dcace5b1ee", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "31dcace5b1ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-51-45-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789587738, "last_seen": 1789587738, "transport": "t", "ja3_hash": "2a6578042c190f969165ccc966785423", "ja3_variant_count": 1, "ja3_variants": [ "2a6578042c190f969165ccc966785423" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_3d16c8249ef5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "3d16c8249ef5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-11-17613-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788945098, "last_seen": 1788945098, "transport": "t", "ja3_hash": "07c619e2f01a11a65a2c552ef19b64a9", "ja3_variant_count": 1, "ja3_variants": [ "07c619e2f01a11a65a2c552ef19b64a9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_3eb7f0d26a79", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "3eb7f0d26a79", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51764-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788967856, "last_seen": 1788967856, "transport": "t", "ja3_hash": "2f041b173a827b8b13e025eee7299109", "ja3_variant_count": 1, "ja3_variants": [ "2f041b173a827b8b13e025eee7299109" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_4c8821db59d8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "4c8821db59d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-35-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789411696, "last_seen": 1789411696, "transport": "t", "ja3_hash": "3a537f7f14f7236d907ceb9c9882f81e", "ja3_variant_count": 1, "ja3_variants": [ "3a537f7f14f7236d907ceb9c9882f81e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_65c886645622", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "65c886645622", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-10-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788866546, "last_seen": 1788866546, "transport": "t", "ja3_hash": "145345d6f5c97eb715884f3b84ccbecd", "ja3_variant_count": 1, "ja3_variants": [ "145345d6f5c97eb715884f3b84ccbecd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_81e3d0738d42", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "81e3d0738d42", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-65281-23-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788515689, "last_seen": 1788515689, "transport": "t", "ja3_hash": "56f208e13ab5ba4ac7065c0bb77e465c", "ja3_variant_count": 1, "ja3_variants": [ "56f208e13ab5ba4ac7065c0bb77e465c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_93ec3ea36b13", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "93ec3ea36b13", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789845096, "last_seen": 1789845096, "transport": "t", "ja3_hash": "7c174abf2f0e8291e8e19346b6566bb3", "ja3_variant_count": 1, "ja3_variants": [ "7c174abf2f0e8291e8e19346b6566bb3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a1d81c2ae94d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a1d81c2ae94d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839903, "last_seen": 1788839903, "transport": "t", "ja3_hash": "4e041b1c0fc3b1abc3ec080681b1d904", "ja3_variant_count": 1, "ja3_variants": [ "4e041b1c0fc3b1abc3ec080681b1d904" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a202b8bd85f2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a202b8bd85f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788552182, "last_seen": 1788552182, "transport": "t", "ja3_hash": "0e05c641c768d17054d39db8bb864170", "ja3_variant_count": 1, "ja3_variants": [ "0e05c641c768d17054d39db8bb864170" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a674c5bdd415", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a674c5bdd415", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-13-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789577404, "last_seen": 1789577404, "transport": "t", "ja3_hash": "0ec1b0734c71b6f13686bb2f8f342b02", "ja3_variant_count": 1, "ja3_variants": [ "0ec1b0734c71b6f13686bb2f8f342b02" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_da8aa5dd8ed0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "da8aa5dd8ed0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51764-35-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789478747, "last_seen": 1789478747, "transport": "t", "ja3_hash": "2efdd0c6b680fa89d5eae8d8d77821b1", "ja3_variant_count": 1, "ja3_variants": [ "2efdd0c6b680fa89d5eae8d8d77821b1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_dc254b3e63fa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "dc254b3e63fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-23-5-17613,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788533133, "last_seen": 1788533133, "transport": "t", "ja3_hash": "20cb196c6e3286b201562479e658e311", "ja3_variant_count": 1, "ja3_variants": [ "20cb196c6e3286b201562479e658e311" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_e081682b17c3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "e081682b17c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-65037-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788903790, "last_seen": 1788903790, "transport": "t", "ja3_hash": "7eea7a4b9ce5f737567bb9aa354c7bce", "ja3_variant_count": 1, "ja3_variants": [ "7eea7a4b9ce5f737567bb9aa354c7bce" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_f37fcd17fffe", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f37fcd17fffe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789582581, "last_seen": 1789582581, "transport": "t", "ja3_hash": "439ad760eda61ca5040d25e18bcbc2f2", "ja3_variant_count": 1, "ja3_variants": [ "439ad760eda61ca5040d25e18bcbc2f2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_7745a645a683", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "7745a645a683", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-27-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788625016, "last_seen": 1789457766, "transport": "t", "ja3_hash": "a515cd40e233cd237af7bab57ea2d4c8", "ja3_variant_count": 2, "ja3_variants": [ "a515cd40e233cd237af7bab57ea2d4c8", "8e5fd246136b7cfa111c8c38254b92cc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_0244615f4da5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "0244615f4da5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-23-51764-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015039, "last_seen": 1789015039, "transport": "t", "ja3_hash": "b66f74a524a04a3a5d4a855d18cd4a8a", "ja3_variant_count": 1, "ja3_variants": [ "b66f74a524a04a3a5d4a855d18cd4a8a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_0e477a0f81f3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "0e477a0f81f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-17613-5-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789047872, "last_seen": 1789047872, "transport": "t", "ja3_hash": "a1b992c2ff8d8a9527d808f6dd0740a7", "ja3_variant_count": 1, "ja3_variants": [ "a1b992c2ff8d8a9527d808f6dd0740a7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_247d44d7f131", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "247d44d7f131", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-51-17613-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789662842, "last_seen": 1789662842, "transport": "t", "ja3_hash": "ab187c085e2c0150d1d3010cf0271782", "ja3_variant_count": 1, "ja3_variants": [ "ab187c085e2c0150d1d3010cf0271782" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_3e4a892e9e67", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "3e4a892e9e67", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-65037-13-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789651384, "last_seen": 1789651384, "transport": "t", "ja3_hash": "5899b3fdc951575a7d9300e50dc178dc", "ja3_variant_count": 1, "ja3_variants": [ "5899b3fdc951575a7d9300e50dc178dc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_4879a369b4ee", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "4879a369b4ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-45-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789715439, "last_seen": 1789715439, "transport": "t", "ja3_hash": "bec52af5c8c68fc82d8617c14bc0d3c6", "ja3_variant_count": 1, "ja3_variants": [ "bec52af5c8c68fc82d8617c14bc0d3c6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_67aba61281a0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "67aba61281a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-51-27-11-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789580056, "last_seen": 1789580056, "transport": "t", "ja3_hash": "aa260a06f5483b6d7ec2c81ecb453af3", "ja3_variant_count": 1, "ja3_variants": [ "aa260a06f5483b6d7ec2c81ecb453af3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_805b947456aa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "805b947456aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-27-35-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789457566, "last_seen": 1789457566, "transport": "t", "ja3_hash": "f0c21b0bb23f5405446563dcbbc49160", "ja3_variant_count": 1, "ja3_variants": [ "f0c21b0bb23f5405446563dcbbc49160" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_8c9359f722f2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "8c9359f722f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-17613-51764-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788610119, "last_seen": 1788610119, "transport": "t", "ja3_hash": "c75f6ca162c0a524a75a67d135893c1a", "ja3_variant_count": 1, "ja3_variants": [ "c75f6ca162c0a524a75a67d135893c1a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_945d5bd8660d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "945d5bd8660d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,17613-65281-51-13-5-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789722661, "last_seen": 1789722661, "transport": "t", "ja3_hash": "7ee4339af1b353af5ea45e046a93749d", "ja3_variant_count": 1, "ja3_variants": [ "7ee4339af1b353af5ea45e046a93749d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_c7869da3bc1d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "c7869da3bc1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-18-51-10-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839899, "last_seen": 1788839899, "transport": "t", "ja3_hash": "5994d0dc73ee0462b7ceeb798e3089f8", "ja3_variant_count": 1, "ja3_variants": [ "5994d0dc73ee0462b7ceeb798e3089f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_fa41407d520a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "fa41407d520a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-27-11-51-65037,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788838673, "last_seen": 1788838673, "transport": "t", "ja3_hash": "fe9c233635eb450c082205decf2ec6a1", "ja3_variant_count": 1, "ja3_variants": [ "fe9c233635eb450c082205decf2ec6a1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_fdc68449c839", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "fdc68449c839", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-17613-18-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789638548, "last_seen": 1789638548, "transport": "t", "ja3_hash": "91513d30ee2383679cb3ff76e47a2062", "ja3_variant_count": 1, "ja3_variants": [ "91513d30ee2383679cb3ff76e47a2062" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_d68b136fe8d9_e7e480e5a997", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "d68b136fe8d9", "c": "e7e480e5a997", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789016475, "last_seen": 1789016475, "transport": "t", "ja3_hash": "e9d8351d9365fe7b2c666bf31aad662f", "ja3_variant_count": 1, "ja3_variants": [ "e9d8351d9365fe7b2c666bf31aad662f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_8f619b424eae", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "8f619b424eae", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-27-18-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789134689, "last_seen": 1789134689, "transport": "t", "ja3_hash": "8cc90659e8ac41ab5a59329c6e20921d", "ja3_variant_count": 1, "ja3_variants": [ "8cc90659e8ac41ab5a59329c6e20921d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_04edf95b0ad5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "04edf95b0ad5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-10-18-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789948972, "last_seen": 1789948972, "transport": "t", "ja3_hash": "42ad1769627fb12e48316514c36b13ed", "ja3_variant_count": 1, "ja3_variants": [ "42ad1769627fb12e48316514c36b13ed" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_1994a38f1d08", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "1994a38f1d08", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-23-65037-10-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789398584, "last_seen": 1789398584, "transport": "t", "ja3_hash": "0d103301e1f351181c473ef1d99aaaa1", "ja3_variant_count": 1, "ja3_variants": [ "0d103301e1f351181c473ef1d99aaaa1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_2aeef566ab24", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "2aeef566ab24", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,10-23-17613-18-35-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789580987, "last_seen": 1789580987, "transport": "t", "ja3_hash": "8aa65c22194d49902c9cf2f2ac82c400", "ja3_variant_count": 1, "ja3_variants": [ "8aa65c22194d49902c9cf2f2ac82c400" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_313881862f12", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "313881862f12", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-18-27-11-51-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789375385, "last_seen": 1789375385, "transport": "t", "ja3_hash": "f58719739bf93e418df1965cadbf2107", "ja3_variant_count": 1, "ja3_variants": [ "f58719739bf93e418df1965cadbf2107" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_32012d139755", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "32012d139755", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-17613-13-45-10-51764,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788723901, "last_seen": 1788723901, "transport": "t", "ja3_hash": "2931c10b9183fc6706afddc381a6a7f8", "ja3_variant_count": 1, "ja3_variants": [ "2931c10b9183fc6706afddc381a6a7f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_421cf2d8d718", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "421cf2d8d718", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-35-10-45-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789112201, "last_seen": 1789112201, "transport": "t", "ja3_hash": "3429b170a45116dae26c0bb85d2249ec", "ja3_variant_count": 1, "ja3_variants": [ "3429b170a45116dae26c0bb85d2249ec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_687b9db53c94", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "687b9db53c94", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-18-11-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789776061, "last_seen": 1789776061, "transport": "t", "ja3_hash": "0de8fd93b2a15d5c6dddb8e918d50efe", "ja3_variant_count": 1, "ja3_variants": [ "0de8fd93b2a15d5c6dddb8e918d50efe" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_6af402bf20c0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "6af402bf20c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-65037-27-35-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789814554, "last_seen": 1789814554, "transport": "t", "ja3_hash": "88faf8104fdad2980340d8225611140a", "ja3_variant_count": 1, "ja3_variants": [ "88faf8104fdad2980340d8225611140a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_7919cf04b481", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "7919cf04b481", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-27-23-13-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788719115, "last_seen": 1788719115, "transport": "t", "ja3_hash": "c6e49604a2113426640264e015b84317", "ja3_variant_count": 1, "ja3_variants": [ "c6e49604a2113426640264e015b84317" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_99bdf495daa1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "99bdf495daa1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-23-65281-45-51-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788968987, "last_seen": 1788968987, "transport": "t", "ja3_hash": "e557bf0d8433cef5c61f65a0dc577786", "ja3_variant_count": 1, "ja3_variants": [ "e557bf0d8433cef5c61f65a0dc577786" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_a6dcce0805ac", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "a6dcce0805ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-65281-10-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789065563, "last_seen": 1789065563, "transport": "t", "ja3_hash": "10eb901c8cf4252c064415063c37712c", "ja3_variant_count": 1, "ja3_variants": [ "10eb901c8cf4252c064415063c37712c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_b2946b7a14ed", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "b2946b7a14ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-13-17613-45-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788570647, "last_seen": 1788570647, "transport": "t", "ja3_hash": "c40202eb1e406ca1d47039253d0b3eee", "ja3_variant_count": 1, "ja3_variants": [ "c40202eb1e406ca1d47039253d0b3eee" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_b50dca8658cf", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "b50dca8658cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-45-10-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788441659, "last_seen": 1788441659, "transport": "t", "ja3_hash": "b2e0d2b872196aabc86d474bc5b051df", "ja3_variant_count": 1, "ja3_variants": [ "b2e0d2b872196aabc86d474bc5b051df" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_b8209d16eb76", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "b8209d16eb76", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-51-27-23-10-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788542027, "last_seen": 1788542027, "transport": "t", "ja3_hash": "dd27d1e24aff608f9134ead3fed81fff", "ja3_variant_count": 1, "ja3_variants": [ "dd27d1e24aff608f9134ead3fed81fff" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_cbd3439583ff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "cbd3439583ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-18-65281-23-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789218772, "last_seen": 1789218772, "transport": "t", "ja3_hash": "27e91a32f76839ce9c967b93c687e5ed", "ja3_variant_count": 1, "ja3_variants": [ "27e91a32f76839ce9c967b93c687e5ed" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_cc0779be0edb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "cc0779be0edb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-17613-23-45-5-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789463338, "last_seen": 1789463338, "transport": "t", "ja3_hash": "b63c5aeace3f6d31322a3ec252fb0b6c", "ja3_variant_count": 1, "ja3_variants": [ "b63c5aeace3f6d31322a3ec252fb0b6c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_d8fe17bb5186", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "d8fe17bb5186", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-13-23-51-10-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788900425, "last_seen": 1788900425, "transport": "t", "ja3_hash": "a5383ee1e16157074fb1da870a001f1c", "ja3_variant_count": 1, "ja3_variants": [ "a5383ee1e16157074fb1da870a001f1c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_f09ea86c8e0a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "f09ea86c8e0a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-35-65037-23-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788866665, "last_seen": 1788866665, "transport": "t", "ja3_hash": "8b39ad5736ee95d4a4744d8b47f2282d", "ja3_variant_count": 1, "ja3_variants": [ "8b39ad5736ee95d4a4744d8b47f2282d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_f7ed08e160c4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "f7ed08e160c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-65037-27-65281-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789466460, "last_seen": 1789466460, "transport": "t", "ja3_hash": "0ac5dccb7c89d25445c1e4e11eed0f75", "ja3_variant_count": 1, "ja3_variants": [ "0ac5dccb7c89d25445c1e4e11eed0f75" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_fbccb213263b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "fbccb213263b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-45-51764-11-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789425382, "last_seen": 1789425382, "transport": "t", "ja3_hash": "48de3a6ac861fecaa0a48f6f7e1551fa", "ja3_variant_count": 1, "ja3_variants": [ "48de3a6ac861fecaa0a48f6f7e1551fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_fef2d5dabe42", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "fef2d5dabe42", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-51-10-65281-45-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788953306, "last_seen": 1788953306, "transport": "t", "ja3_hash": "a82d6c992723148bc09ca4814242b88f", "ja3_variant_count": 1, "ja3_variants": [ "a82d6c992723148bc09ca4814242b88f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_c745986123b2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "c745986123b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-18-65037-17613-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788623857, "last_seen": 1788623857, "transport": "t", "ja3_hash": "a2fc9b380e8bbfa56a506d0094edc566", "ja3_variant_count": 1, "ja3_variants": [ "a2fc9b380e8bbfa56a506d0094edc566" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_1182c0001add", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "1182c0001add", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-10-18-11-65037-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789720576, "last_seen": 1789720576, "transport": "t", "ja3_hash": "fade8736c7bf9a09d029be9aeeb3d9eb", "ja3_variant_count": 1, "ja3_variants": [ "fade8736c7bf9a09d029be9aeeb3d9eb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_27ce5fc7f32f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "27ce5fc7f32f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-13-10-45-35-27-5,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789430574, "last_seen": 1789430574, "transport": "t", "ja3_hash": "109e8c59643bf49e1af666a1ef05be96", "ja3_variant_count": 1, "ja3_variants": [ "109e8c59643bf49e1af666a1ef05be96" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_4a658035ce01", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "4a658035ce01", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-18-35-11-27-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788889496, "last_seen": 1788889496, "transport": "t", "ja3_hash": "13d3bc354432edb32078c7db75c98620", "ja3_variant_count": 1, "ja3_variants": [ "13d3bc354432edb32078c7db75c98620" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_63aba6a9e593", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "63aba6a9e593", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-11-45-23-5-65281-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789880528, "last_seen": 1789880528, "transport": "t", "ja3_hash": "2faeddb0f308167f4de4c807fbdb19d1", "ja3_variant_count": 1, "ja3_variants": [ "2faeddb0f308167f4de4c807fbdb19d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_84d6b11c5164", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "84d6b11c5164", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-23-51-11-45-10-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789820708, "last_seen": 1789820708, "transport": "t", "ja3_hash": "5bccf670c4c917607da3d16e10680524", "ja3_variant_count": 1, "ja3_variants": [ "5bccf670c4c917607da3d16e10680524" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_8b5bd30a4bda", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "8b5bd30a4bda", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-51-5-10-11-18-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789734402, "last_seen": 1789734402, "transport": "t", "ja3_hash": "01083658063e8b796ada470dcdea6ec5", "ja3_variant_count": 1, "ja3_variants": [ "01083658063e8b796ada470dcdea6ec5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_ac6d7d3928e6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "ac6d7d3928e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-27-18-45-10-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024395, "last_seen": 1789024395, "transport": "t", "ja3_hash": "e91ff2b5252f817aabd30d3ac0c758f8", "ja3_variant_count": 1, "ja3_variants": [ "e91ff2b5252f817aabd30d3ac0c758f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_c2f3a15180e3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "c2f3a15180e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-13-17613-23-35-51-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789617350, "last_seen": 1789617350, "transport": "t", "ja3_hash": "21779b42ae12628c99b2a2e02eaef1c0", "ja3_variant_count": 1, "ja3_variants": [ "21779b42ae12628c99b2a2e02eaef1c0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_daba6ed279e1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "daba6ed279e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-35-18-65281-5-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789813434, "last_seen": 1789813434, "transport": "t", "ja3_hash": "10b397c7f665999c6f5f45bcc3908d14", "ja3_variant_count": 1, "ja3_variants": [ "10b397c7f665999c6f5f45bcc3908d14" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_e47fd13f142d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "e47fd13f142d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-35-13-11-10-51-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788739906, "last_seen": 1788739906, "transport": "t", "ja3_hash": "12a97e7334869d14586eb8d013c914ba", "ja3_variant_count": 1, "ja3_variants": [ "12a97e7334869d14586eb8d013c914ba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_e73e6c74de17", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "e73e6c74de17", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,4832-13-35-17613-11-45-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788481951, "last_seen": 1788481951, "transport": "t", "ja3_hash": "65d4107a1080c83203d0b18a3b399d8b", "ja3_variant_count": 1, "ja3_variants": [ "65d4107a1080c83203d0b18a3b399d8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_ebac0085aa10", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "ebac0085aa10", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-17613-10-35-23-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789390439, "last_seen": 1789390439, "transport": "t", "ja3_hash": "80dc28c07c6543767d7a6b8c046c4dbe", "ja3_variant_count": 1, "ja3_variants": [ "80dc28c07c6543767d7a6b8c046c4dbe" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_ebd478606790", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "ebd478606790", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-13-51-10-27-11-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789624096, "last_seen": 1789624096, "transport": "t", "ja3_hash": "0eee5f319aad6d455b47070512a69dee", "ja3_variant_count": 1, "ja3_variants": [ "0eee5f319aad6d455b47070512a69dee" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_f59b0e7c6b94", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "f59b0e7c6b94", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-11-27-51-10-17613-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789273191, "last_seen": 1789273191, "transport": "t", "ja3_hash": "00c68c235dad2ba8ab1506fe99e0984c", "ja3_variant_count": 1, "ja3_variants": [ "00c68c235dad2ba8ab1506fe99e0984c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_30e1ab43fcd7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "30e1ab43fcd7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-4832-23-11-10-65281-45-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788561564, "last_seen": 1788561564, "transport": "t", "ja3_hash": "2c02a8886f6bf13d955ec645740ba8a2", "ja3_variant_count": 1, "ja3_variants": [ "2c02a8886f6bf13d955ec645740ba8a2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_6872b0a511c5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "6872b0a511c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-27-23-18-45-13-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788827067, "last_seen": 1788827067, "transport": "t", "ja3_hash": "b712d81458f9bb6c37c7b5be48f44b57", "ja3_variant_count": 1, "ja3_variants": [ "b712d81458f9bb6c37c7b5be48f44b57" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_d2304f9bd766", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "d2304f9bd766", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-23-5-13-18-51-17613-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788459814, "last_seen": 1788459814, "transport": "t", "ja3_hash": "7a5fdb6cfe16d0e5321b6e16b755ee5d", "ja3_variant_count": 1, "ja3_variants": [ "7a5fdb6cfe16d0e5321b6e16b755ee5d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_d64835f94562", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "d64835f94562", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-23-11-65281-65037-5-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789283216, "last_seen": 1789283216, "transport": "t", "ja3_hash": "dfd7f2a8a20ebd3f23804a8aa16b87f6", "ja3_variant_count": 1, "ja3_variants": [ "dfd7f2a8a20ebd3f23804a8aa16b87f6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_f6408215eadb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "f6408215eadb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-51-35-65281-17613-18-23-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789024338, "last_seen": 1789024338, "transport": "t", "ja3_hash": "c7a7df4cf91a79f6de968f2c620bc757", "ja3_variant_count": 1, "ja3_variants": [ "c7a7df4cf91a79f6de968f2c620bc757" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_01f562deb691", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "01f562deb691", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-27-23-45-13-65037-35-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789063163, "last_seen": 1789063163, "transport": "t", "ja3_hash": "9b4ac02c600caa1f0d4b6ae57557515c", "ja3_variant_count": 1, "ja3_variants": [ "9b4ac02c600caa1f0d4b6ae57557515c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_29886661fa57", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "29886661fa57", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-18-10-51-17613-45-5-65281-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789651395, "last_seen": 1789651395, "transport": "t", "ja3_hash": "b0fb51eccc047d929770a9765b3af49f", "ja3_variant_count": 1, "ja3_variants": [ "b0fb51eccc047d929770a9765b3af49f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_482cff946a4e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "482cff946a4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-45-27-11-51-23-65281-10-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789269983, "last_seen": 1789269983, "transport": "t", "ja3_hash": "689bd60904c44fbc7e8640f5dd4e0214", "ja3_variant_count": 1, "ja3_variants": [ "689bd60904c44fbc7e8640f5dd4e0214" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_8462dad036ee", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "8462dad036ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-65281-13-51764-5-23-27-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789338151, "last_seen": 1789338151, "transport": "t", "ja3_hash": "87f401b8bf7f74f9b3d6b5dcb0fa447d", "ja3_variant_count": 1, "ja3_variants": [ "87f401b8bf7f74f9b3d6b5dcb0fa447d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_b84e1c3297c6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "b84e1c3297c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-18-27-13-45-35-65281-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789218772, "last_seen": 1789218772, "transport": "t", "ja3_hash": "aa61ebd6555d2913c3c437a96ec72699", "ja3_variant_count": 1, "ja3_variants": [ "aa61ebd6555d2913c3c437a96ec72699" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_c4ab09096119", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "c4ab09096119", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-65281-35-45-23-27-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789059656, "last_seen": 1789059656, "transport": "t", "ja3_hash": "9610cc7886688598fdad2f9a4ba23e9f", "ja3_variant_count": 1, "ja3_variants": [ "9610cc7886688598fdad2f9a4ba23e9f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_d5542cd256a2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "d5542cd256a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-65281-23-18-17613-27-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788870932, "last_seen": 1788870932, "transport": "t", "ja3_hash": "17c2bc44124fb6b0c9c77e9b97ccd02d", "ja3_variant_count": 1, "ja3_variants": [ "17c2bc44124fb6b0c9c77e9b97ccd02d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_d5d0dfbe9a7f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "d5d0dfbe9a7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-11-18-27-65281-65037-10-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508421, "last_seen": 1788508421, "transport": "t", "ja3_hash": "4502c9a87aa19c9d9e0489266c46832c", "ja3_variant_count": 1, "ja3_variants": [ "4502c9a87aa19c9d9e0489266c46832c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_f1fd2a088266", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "f1fd2a088266", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-27-10-45-18-35-65281-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788455443, "last_seen": 1788455443, "transport": "t", "ja3_hash": "68a81b9bbc6f3edf514da7f4f53ca0f0", "ja3_variant_count": 1, "ja3_variants": [ "68a81b9bbc6f3edf514da7f4f53ca0f0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151100_8daaf6152771_14ec9f72a66f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151100", "b": "8daaf6152771", "c": "14ec9f72a66f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-35-23-13-45-51764-11-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789163819, "last_seen": 1789163819, "transport": "t", "ja3_hash": "19c79e63f9bb1f523dc3bb0d39646bbc", "ja3_variant_count": 1, "ja3_variants": [ "19c79e63f9bb1f523dc3bb0d39646bbc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151100_8daaf6152771_97dcd5df63d3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151100", "b": "8daaf6152771", "c": "97dcd5df63d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-27-23-17613-5-45-65037-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789482544, "last_seen": 1789482544, "transport": "t", "ja3_hash": "495c74266eb212091cbc8d491d9a73e5", "ja3_variant_count": 1, "ja3_variants": [ "495c74266eb212091cbc8d491d9a73e5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151200_8daaf6152771_6dd9beb9e8e7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151200", "b": "8daaf6152771", "c": "6dd9beb9e8e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-51-17613-23-65281-35-10-5-45-18-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789651391, "last_seen": 1789651391, "transport": "t", "ja3_hash": "b1bb23992a7593dc3dfcc88f104e53cf", "ja3_variant_count": 1, "ja3_variants": [ "b1bb23992a7593dc3dfcc88f104e53cf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151300_8daaf6152771_3bb554c0827c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151300", "b": "8daaf6152771", "c": "3bb554c0827c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-10-65281-23-45-17613-5-18-13-27-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788848238, "last_seen": 1788848238, "transport": "t", "ja3_hash": "0e45700daf8732684cdfe09886a41b25", "ja3_variant_count": 1, "ja3_variants": [ "0e45700daf8732684cdfe09886a41b25" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i160100_09c69efcb4db_af088bb94252", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i160100", "b": "09c69efcb4db", "c": "af088bb94252", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 16, "extension_count": 1, "alpn": null } }, "ja3_string": "771,47-10-19-57-4-49195-49199-49196-49200-52393-52392-49171-49172-156-157-53,13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1787847663, "last_seen": 1788572942, "transport": "t", "ja3_hash": "799b30521ece672fae5d0cec76e8d728", "ja3_variant_count": 1, "ja3_variants": [ "799b30521ece672fae5d0cec76e8d728" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i160700_8cdfa2d4673b_ac0d2f4ec206", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i160700", "b": "8cdfa2d4673b", "c": "ac0d2f4ec206", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 16, "extension_count": 7, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10,5-10-11-13-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 118, "first_seen": 1787506164, "last_seen": 1789964321, "transport": "t", "ja3_hash": "1ded1585cb6c61b529e75ada28fb83a4", "ja3_variant_count": 1, "ja3_variants": [ "1ded1585cb6c61b529e75ada28fb83a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i170700_5b57614c22b0_72474e793a45", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i170700", "b": "5b57614c22b0", "c": "72474e793a45", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,23-65281-10-11-35-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788480426, "last_seen": 1789105473, "transport": "t", "ja3_hash": "d96c1d2ceaa1ed7410be3e41e572a4d0", "ja3_variant_count": 2, "ja3_variants": [ "d96c1d2ceaa1ed7410be3e41e572a4d0", "83808e66b02872002c3a9e4de6f75d6a" ], "user_agents": { "libredtail-http": 49 }, "ua_disagreement": false } }, { "hash": "t12i190700_d83cc789557e_16bbda4055b2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i190700", "b": "d83cc789557e", "c": "16bbda4055b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,5-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789883397, "last_seen": 1789883397, "transport": "t", "ja3_hash": "72a589da586844d7f0818ce684948eea", "ja3_variant_count": 1, "ja3_variants": [ "72a589da586844d7f0818ce684948eea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i200600_22c523c4c553_2dae41c691ec", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i200600", "b": "22c523c4c553", "c": "2dae41c691ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788660199, "last_seen": 1789495599, "transport": "t", "ja3_hash": "113d359fe776f0b5704058d8b6474b77", "ja3_variant_count": 1, "ja3_variants": [ "113d359fe776f0b5704058d8b6474b77" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i210600_76e208dd3e22_f28add8e7af0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i210600", "b": "76e208dd3e22", "c": "f28add8e7af0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 21, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787818148, "last_seen": 1789132429, "transport": "t", "ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35", "ja3_variant_count": 1, "ja3_variants": [ "c12f54a3f91dc7bafd92cb59fe009a35" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i230700_31bea9ec6298_ac0d2f4ec206", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i230700", "b": "31bea9ec6298", "c": "ac0d2f4ec206", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 23, "extension_count": 7, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49161-158-52392-52394-51-61-22-49162-57-49171-10-49172-156-157-47-53-49170,5-10-11-13-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787847005, "last_seen": 1789881201, "transport": "t", "ja3_hash": "c725869cef931ac26d9adb2cebee59d0", "ja3_variant_count": 1, "ja3_variants": [ "c725869cef931ac26d9adb2cebee59d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i250300_8b6f115445cc_15cf763851c4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i250300", "b": "8b6f115445cc", "c": "15cf763851c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 3, "alpn": null } }, "ja3_string": "771,163-159-107-106-57-56-136-135-162-158-103-64-51-50-154-153-69-68-22-19-21-18-20-17-255,35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788685060, "last_seen": 1789264663, "transport": "t", "ja3_hash": "5c6742b9d3940f70850ee675a5fdb1f0", "ja3_variant_count": 1, "ja3_variants": [ "5c6742b9d3940f70850ee675a5fdb1f0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i280800_0df5e5c63df4_686390af6b8e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i280800", "b": "0df5e5c63df4", "c": "686390af6b8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 28, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,5-10-11-13-50-17-23-43,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787496480, "last_seen": 1788637919, "transport": "t", "ja3_hash": "ca39305c183742559eb9946bcb9dc220", "ja3_variant_count": 1, "ja3_variants": [ "ca39305c183742559eb9946bcb9dc220" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i280900_0df5e5c63df4_f30da352415d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i280900", "b": "0df5e5c63df4", "c": "f30da352415d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 28, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,5-10-11-17-23-35-13-43-50,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789364875, "last_seen": 1789364875, "transport": "t", "ja3_hash": "4b87071f1e281a29892a3ed863c6cff5", "ja3_variant_count": 1, "ja3_variants": [ "4b87071f1e281a29892a3ed863c6cff5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i300600_27daee6acec1_3c5a66c06c35", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i300600", "b": "27daee6acec1", "c": "3c5a66c06c35", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49195-52393-49196-49161-49162-49187-49188-49199-52392-49200-49171-49172-49191-49192-158-52394-159-51-57-103-107-156-157-60-61-47-53-10-5-255,11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 214, "first_seen": 1787444126, "last_seen": 1789959321, "transport": "t", "ja3_hash": "9812cdc989e02988bd1f0734fb6ed1a5", "ja3_variant_count": 1, "ja3_variants": [ "9812cdc989e02988bd1f0734fb6ed1a5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i320300_992cb694dc73_1ea9011b3dfa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i320300", "b": "992cb694dc73", "c": "1ea9011b3dfa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 32, "extension_count": 3, "alpn": null } }, "ja3_string": "771,136-150-156-157-158-159-255-49154-49155-49156-49157-49159-49160-49161-49162-49164-49165-49166-49167-49169-49170-49171-49172-49187-49188-49191-49195-49196-49199-49200-49201-49202,11-10-13,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787509865, "last_seen": 1789900799, "transport": "t", "ja3_hash": "73093a575f06249c4e9af8b3f1accf00", "ja3_variant_count": 1, "ja3_variants": [ "73093a575f06249c4e9af8b3f1accf00" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i330500_5172cef6ed69_021165082e1c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i330500", "b": "5172cef6ed69", "c": "021165082e1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 33, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49162-49161-49160-49192-49191-49172-49171-49170-61-60-53-47-10-49159-49169-5-4-49195-49199-156,5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 104, "first_seen": 1787659767, "last_seen": 1789868258, "transport": "t", "ja3_hash": "02f32644e1b0655c19aaa3a2d6778b1e", "ja3_variant_count": 1, "ja3_variants": [ "02f32644e1b0655c19aaa3a2d6778b1e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i340100_280581216cf5_e2a7de7a8184", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i340100", "b": "280581216cf5", "c": "e2a7de7a8184", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 34, "extension_count": 1, "alpn": null } }, "ja3_string": "771,4-5-10-13-16-19-22-47-48-49-50-51-53-54-55-56-57-60-61-62-63-64-65-68-69-102-103-104-105-106-107-132-135-255,13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 35, "first_seen": 1787509866, "last_seen": 1789900803, "transport": "t", "ja3_hash": "524ee2140c42a7c18bb1f571838920c0", "ja3_variant_count": 1, "ja3_variants": [ "524ee2140c42a7c18bb1f571838920c0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i460900_5f5519fb12cc_1f7ae294493e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i460900", "b": "5f5519fb12cc", "c": "1f7ae294493e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 46, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,5-10-11-17-23-35-13-43-50,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788737393, "last_seen": 1788737393, "transport": "t", "ja3_hash": "e5366eba948b57f85abd35fbefe42ab8", "ja3_variant_count": 1, "ja3_variants": [ "e5366eba948b57f85abd35fbefe42ab8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i520700_3874cc0afe49_e59803268f14", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i520700", "b": "3874cc0afe49", "c": "e59803268f14", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 52, "extension_count": 7, "alpn": null } }, "ja3_string": "771,52244-52243-49199-49195-49200-49196-49169-49159-49191-49187-49171-49161-49192-49188-49172-49162-52245-158-159-103-107-51-57-5-4-156-157-60-61-47-53-49170-22-10-3-8-6-20-17-25-23-50-49160-18-19-21-56-64-102-106-162-163,5-10-11-13-65281-15-18,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789168137, "last_seen": 1789310807, "transport": "t", "ja3_hash": "7bbd07c800a4622ee5d17f7cd8e090a8", "ja3_variant_count": 1, "ja3_variants": [ "7bbd07c800a4622ee5d17f7cd8e090a8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i570500_2a2bed94251f_a1e935682795", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i570500", "b": "2a2bed94251f", "c": "a1e935682795", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 57, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-49177-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-49176-49201-49197-49193-49189-49166-49156-156-60-47-150-65-49169-49159-49174-49164-49154-5-4-49170-49160-49175-49165-49155-10-49168-49158-49173-49163-49153-59-2-1-255,11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 12, "first_seen": 1787697752, "last_seen": 1789425143, "transport": "t", "ja3_hash": "588552cc67787a99af4abff0d403246f", "ja3_variant_count": 1, "ja3_variants": [ "588552cc67787a99af4abff0d403246f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_13a2a23d501b_99875426d20b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "13a2a23d501b", "c": "99875426d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182-49185-49178-49181-49184,11-10-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820544, "last_seen": 1789485428, "transport": "t", "ja3_hash": "959859366519cbdef2c6991b03378ef0", "ja3_variant_count": 1, "ja3_variants": [ "959859366519cbdef2c6991b03378ef0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_1715b94e3896_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "1715b94e3896", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,98-97-96-100-8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748802, "last_seen": 1789646810, "transport": "t", "ja3_hash": "828a5add4bfafbe0fa24637a22cca1d1", "ja3_variant_count": 1, "ja3_variants": [ "828a5add4bfafbe0fa24637a22cca1d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_1e98fdfb27e9_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "1e98fdfb27e9", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49411-49413-49409-49412-49414-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748808, "last_seen": 1789646815, "transport": "t", "ja3_hash": "e08e2d7f10c70b2cee08b9d63dbfed58", "ja3_variant_count": 1, "ja3_variants": [ "e08e2d7f10c70b2cee08b9d63dbfed58" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_67f0ca237a44_99875426d20b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "67f0ca237a44", "c": "99875426d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138-98-97-96-100,11-10-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820543, "last_seen": 1789485427, "transport": "t", "ja3_hash": "68082d845dc2534498110c423f39473b", "ja3_variant_count": 1, "ja3_variants": [ "68082d845dc2534498110c423f39473b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_a3acda31d846_99875426d20b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "a3acda31d846", "c": "99875426d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,11-10-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820542, "last_seen": 1789485425, "transport": "t", "ja3_hash": "63c56605bc721bba4b0e7f1cb2d5779d", "ja3_variant_count": 1, "ja3_variants": [ "63c56605bc721bba4b0e7f1cb2d5779d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_a3acda31d846_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "a3acda31d846", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748806, "last_seen": 1789646814, "transport": "t", "ja3_hash": "750e52561b0bd913cc818db50258e912", "ja3_variant_count": 1, "ja3_variants": [ "750e52561b0bd913cc818db50258e912" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_e31a90cd0803_99875426d20b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "e31a90cd0803", "c": "99875426d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,11-10-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820545, "last_seen": 1789485428, "transport": "t", "ja3_hash": "6ea56d00087701f5f5966aa8b8934588", "ja3_variant_count": 1, "ja3_variants": [ "6ea56d00087701f5f5966aa8b8934588" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_e31a90cd0803_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "e31a90cd0803", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748807, "last_seen": 1789646815, "transport": "t", "ja3_hash": "c5eb8e5c26ad136adf35aa344958ff7f", "ja3_variant_count": 1, "ja3_variants": [ "c5eb8e5c26ad136adf35aa344958ff7f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_e7b476f9520b_99875426d20b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "e7b476f9520b", "c": "99875426d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,11-10-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820540, "last_seen": 1789485425, "transport": "t", "ja3_hash": "459efaaa689b1ca1bec85684cf67ad3f", "ja3_variant_count": 1, "ja3_variants": [ "459efaaa689b1ca1bec85684cf67ad3f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_e7b476f9520b_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "e7b476f9520b", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748807, "last_seen": 1789646815, "transport": "t", "ja3_hash": "6c33bc0be081a797d722d9fac5701296", "ja3_variant_count": 1, "ja3_variants": [ "6c33bc0be081a797d722d9fac5701296" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_f559eb9565fd_99875426d20b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "f559eb9565fd", "c": "99875426d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,11-10-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820542, "last_seen": 1789485426, "transport": "t", "ja3_hash": "0b2c4fb4f756d343be439d5da03aed59", "ja3_variant_count": 1, "ja3_variants": [ "0b2c4fb4f756d343be439d5da03aed59" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_f559eb9565fd_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "f559eb9565fd", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748808, "last_seen": 1789646815, "transport": "t", "ja3_hash": "0e9605b8aa092831a4d7ec86dc1e758b", "ja3_variant_count": 1, "ja3_variants": [ "0e9605b8aa092831a4d7ec86dc1e758b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i700500_b8b0f76b4bb5_a1e935682795", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i700500", "b": "b8b0f76b4bb5", "c": "a1e935682795", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 70, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49200-49196-49202-49198-49199-49195-49201-49197-165-163-161-159-164-162-160-158-49192-49188-49172-49162-49194-49190-49167-49157-107-106-105-104-57-56-55-54-49191-49187-49171-49161-49193-49189-49166-49156-103-64-63-62-51-50-49-48-136-135-134-133-69-68-67-66-157-156-61-53-60-47-132-65-49169-49159-49164-49154-5-255,11-10-35-13-15,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788646460, "last_seen": 1788646460, "transport": "t", "ja3_hash": "7233131c9641dc3d3c77395c1ff2e9b6", "ja3_variant_count": 1, "ja3_variants": [ "7233131c9641dc3d3c77395c1ff2e9b6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i990300_0df3f6915705_071c21b1fa59", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i990300", "b": "0df3f6915705", "c": "071c21b1fa59", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 99, "extension_count": 3, "alpn": null } }, "ja3_string": "771,160-49261-49180-49185-49163-49268-49241-52394-136-49250-49325-49158-187-74-193-54-64-52244-49207-49168-143-49201-50-49279-49331-49297-52393-179-171-49232-66-49304-53253-49217-76-71-49234-49175-4870-81-84-163-49211-49249-147-49170-172-49258-68-104-49294-49266-146-70-49323-49319-65278-181-51-77-29-49300-61-34-49312-124-192-116-75-52398-167-49194-197-53-57-49332-46-180-49155-17-96-186-49246-12-40-49166-196-15-97-131-5-49282-128-28-170-49212-198-119-52395-1-157-152-98-4867-49156-103-4871-49172-49293-72-10-69-88-49231-145-20-49202-49193-49313-49154-4869-38-4868-41-49269-49308-4866-4865-65279-156-49190-49326-49411-178-49314-52243-49272-190-49216-120-32-92-43-100-125-52396-52392-49265-105-52245-49287-53250-49414-49248-141-44-49157-49165-11-35-4-49410-59-114-49408-49333-49330-151-139-49329-86-89-49327-49324-49299-49184-49233-49320-49206-49153-49292-27-49225-49316-49315-53251-49311-49310-49309-49209-49223-49239-49177-176-49247-37-49220-24-33-49303-49295-73-49281-49291-49301-49298-45-49296-47-18-164-49317-49290-49289-140-49288-7-49286-49285-49284-188-49221-49198-121-49302-49280-49208-9-49277-182-62-22-52-49178-101-49271-183-26-49276-49275-49274-177-132-53249-49187-49270-60-49267-49328-56-135-49260-49171-78-49259-49252-49173-49219-189-14-55-49255-49254-49253-49161-49305-30-49245-49244-49256-79-90-162-49262-2-166-49307-49238-49237-129-49236-49167-80-49321-49230-49229-49228-49227-23-49226-102-49222-49224-42-126-6-150-49218-138-49243-49-83-169-63-49210-49192-49278-49215-49204-49203-49191-49200-49199-49197-8-142-49162-49196-0-49264-168-161-49188-19-39-165-49322-49183-49182-49181-3-49179-108-49176-191-49174-49257-25-49169-49235-49412-49164-115-49251-49160-49159-199-87-154-134-65-58-16-49318-49240-148-194-52397-49214-13-155-158-149-21-49283-185-85-49273-49306-175-48-91-49413-173-153-49189-49186-49242-159-144-174-49205-137-31-195-49213-130-109-107-49195-99-106-184-133-82-36-67-49409-49263,10-15-13,23-24-25-29-256-4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 4870, "name": "4870 (0x1306)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4871, "name": "4871 (0x1307)", "known": false }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1788737426, "last_seen": 1789364935, "transport": "t", "ja3_hash": "243b1c57d0c94e6b05b220d541281d7c", "ja3_variant_count": 5, "ja3_variants": [ "243b1c57d0c94e6b05b220d541281d7c", "8d8844f72415e1293e36b4df8a5ef3fa", "2e52ac7f5d41255a352402a340d0c8a6", "aa82b4c88a71a80e83685286b3b28a52", "8550470887205f8a73d1458115d0864b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i990500_b17e8abcd084_d6ccc26a9df5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i990500", "b": "b17e8abcd084", "c": "d6ccc26a9df5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 99, "extension_count": 5, "alpn": null } }, "ja3_string": "771,0-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-59-138-139-142-143-146-147-176-177-180-181-184-185-49153-49154-49155-49158-49159-49160-49163-49164-49165-49168-49169-49170-49173-49174-49175-49178-49179-49180-49203-49204-49209-49210-49211-49161-49162-49171-49172-49195-49196-49199-49200-52392-52393-47-53-60-61-156-157-49187-49188-49191-49192,65281-10-11-13-23,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 19, "first_seen": 1787497605, "last_seen": 1789934749, "transport": "t", "ja3_hash": "9bcb56367336f5ef69ae82a8fa79cf2f", "ja3_variant_count": 1, "ja3_variants": [ "9bcb56367336f5ef69ae82a8fa79cf2f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i990600_a40d17a72bcb_4446390ac224", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i990600", "b": "a40d17a72bcb", "c": "4446390ac224", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 99, "extension_count": 6, "alpn": null } }, "ja3_string": "771,5-4-2-1-22-51-57-58-24-53-10-27-47-52-49168-49158-49173-49163-49153-59-49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-56-55-54-136-135-134-133-49177-167-109-137-49202-49198-49194-49190-49167-49157-157-61-132-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-50-49-48-154-153-152-151-69-68-67-66-49176-166-108-155-70-49201-49197-49193-49189-49166-49156-156-60-150-65-49170-49160-19-16-13-49175-49165-49155-7-49169-49159-49174-49164-49154-255,11-10-35-13-15-21,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 58, "first_seen": 1787911747, "last_seen": 1789142258, "transport": "t", "ja3_hash": "548f8886dcfeeab8d28d3346a63b70c5", "ja3_variant_count": 1, "ja3_variants": [ "548f8886dcfeeab8d28d3346a63b70c5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d131300_f57a46bbacb6_db66201a557f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "LeakIX l9scan \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131300", "b": "f57a46bbacb6", "c": "db66201a557f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 13, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-43-51-45,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 51, "first_seen": 1787606003, "last_seen": 1789915059, "transport": "t", "ja3_hash": "09ed92ccbc8eac201dc0fb108a58d04f", "ja3_variant_count": 1, "ja3_variants": [ "09ed92ccbc8eac201dc0fb108a58d04f" ], "user_agents": { "SofyaBot/1.0 (+https://sofya.co/bot)": 3, "Mozilla/5.0 (l9scan/2.0.1353e25393e2937313e26363; +https://leakix.net)": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 4 }, "ua_disagreement": true } }, { "hash": "t13d131400_f57a46bbacb6_5b9f26b9c901", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "LeakIX l9scan \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131400", "b": "f57a46bbacb6", "c": "5b9f26b9c901", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 14, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-43-51-45-41,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 523, "first_seen": 1787606006, "last_seen": 1789915068, "transport": "t", "ja3_hash": "0980a0280c6477e5141882ed4a3217bd", "ja3_variant_count": 1, "ja3_variants": [ "0980a0280c6477e5141882ed4a3217bd" ], "user_agents": { "Mozilla/5.0 (l9scan/2.0.1353e25393e2937313e26363; +https://leakix.net)": 142, "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)": 4, "Mozilla/5.0 (compatible; meta-externalagent/1.1; +https://developers.facebook.com/docs/sharing/webmasters/crawler)": 4 }, "ua_disagreement": true } }, { "hash": "t13d150800_8daaf6152771_1cdbd3ccf684", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "1cdbd3ccf684", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-5-0-11-65037-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788656555, "last_seen": 1788656555, "transport": "t", "ja3_hash": "0e1cb56b7a9d49980c3b5977f850de26", "ja3_variant_count": 1, "ja3_variants": [ "0e1cb56b7a9d49980c3b5977f850de26" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_26b6e44d6663", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "26b6e44d6663", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-11-0-35-23-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789754525, "last_seen": 1789754525, "transport": "t", "ja3_hash": "be4b8a8a4451041df07793e445c04b5d", "ja3_variant_count": 1, "ja3_variants": [ "be4b8a8a4451041df07793e445c04b5d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_ac5ee1d2f7ad", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "ac5ee1d2f7ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-10-35-18-17613-11-0-27-45-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789949156, "last_seen": 1789949156, "transport": "t", "ja3_hash": "8f3b6c219d05060d051953d03d7b8375", "ja3_variant_count": 1, "ja3_variants": [ "8f3b6c219d05060d051953d03d7b8375" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_0d023f2dc25d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "0d023f2dc25d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-0-5-10-16-43-23-11-45-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789439003, "last_seen": 1789439003, "transport": "t", "ja3_hash": "36b024b2b4b36636a2d881727c929d48", "ja3_variant_count": 1, "ja3_variants": [ "36b024b2b4b36636a2d881727c929d48" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_4b3619f2f796", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "4b3619f2f796", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-65037-43-27-18-10-45-16-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789949146, "last_seen": 1789949146, "transport": "t", "ja3_hash": "d66cefc6aa4dee43436da6a9f69794c8", "ja3_variant_count": 1, "ja3_variants": [ "d66cefc6aa4dee43436da6a9f69794c8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_8136a903b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "8136a903b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-18-43-45-65037-11-17613-23-13-27-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788448533, "last_seen": 1788448533, "transport": "t", "ja3_hash": "a28866b5109f8ffe841dd5561ac8ce31", "ja3_variant_count": 1, "ja3_variants": [ "a28866b5109f8ffe841dd5561ac8ce31" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_21c62da62278", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "21c62da62278", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-10-0-35-13-5-17613-16-43-27-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789516844, "last_seen": 1789516844, "transport": "t", "ja3_hash": "d976cda27ea2a9ee35e0369d92180f3c", "ja3_variant_count": 1, "ja3_variants": [ "d976cda27ea2a9ee35e0369d92180f3c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_575ccd9a49f1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "575ccd9a49f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-17613-13-11-18-65037-65281-35-0-45-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788469373, "last_seen": 1788469373, "transport": "t", "ja3_hash": "39265c1813bb5804be59dc31c92ce29c", "ja3_variant_count": 1, "ja3_variants": [ "39265c1813bb5804be59dc31c92ce29c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_d161217c7c0e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "d161217c7c0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-0-5-43-23-45-27-65281-17613-65037-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788557908, "last_seen": 1788557908, "transport": "t", "ja3_hash": "82c99e1abb244e1915d572ccf9cd2366", "ja3_variant_count": 1, "ja3_variants": [ "82c99e1abb244e1915d572ccf9cd2366" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_b55edfc313ff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "b55edfc313ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-10-65281-65037-35-45-43-11-5-18-27-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789218781, "last_seen": 1789218781, "transport": "t", "ja3_hash": "06fd42eb21dbb5106ce0cd19d82492d3", "ja3_variant_count": 1, "ja3_variants": [ "06fd42eb21dbb5106ce0cd19d82492d3" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_382d3b6b503d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "382d3b6b503d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-11-45-16-0-27-18-5-17613-13-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789950138, "last_seen": 1789950138, "transport": "t", "ja3_hash": "4e087692f2c098f7f078d1af38298fda", "ja3_variant_count": 1, "ja3_variants": [ "4e087692f2c098f7f078d1af38298fda" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_f7b3724c8ded", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "f7b3724c8ded", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-17613-16-0-5-18-45-35-23-43-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789754439, "last_seen": 1789754439, "transport": "t", "ja3_hash": "fb626685fd9fea0a3a9afcf5983a76e1", "ja3_variant_count": 1, "ja3_variants": [ "fb626685fd9fea0a3a9afcf5983a76e1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_fdea054b141e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "fdea054b141e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-10-43-23-65037-5-27-35-17613-16-18-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789027843, "last_seen": 1789902876, "transport": "t", "ja3_hash": "780b6e5a889761239303b4df5d3e6d9c", "ja3_variant_count": 2, "ja3_variants": [ "780b6e5a889761239303b4df5d3e6d9c", "b90709dbd7605b89c6e58c64296755f2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_db113fc12e09", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "db113fc12e09", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-65281-17613-11-45-16-27-0-35-43-18-10-65037-51-23,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10853, "first_seen": 1788442619, "last_seen": 1789968320, "transport": "t", "ja3_hash": "17332c4d59d8d9f5e95f42b5c7c3e34f", "ja3_variant_count": 10826, "ja3_variants": [ "17332c4d59d8d9f5e95f42b5c7c3e34f", "832a6e5172b32528b7e4e05c9fa1b107", "10186620f7fb473705788c2d96e9c847", "40c1a23b7fc59bd9f14b42a8797be276", "cfbf8f8130f61ad58f5e943efbaa2d8d", "c509b703f0c937b437bdc5a2a75151fe", "681b55637d15773934c175e54efb6646", "49b406c6ea7b94da8e86bef7ee4a380b", "e60a8d85dfdde4f740cf5c21bf5ecdf3", "55a05e7449b5df54d9a69c1919ef3030", "e7c1f80ab63be0418225482aa98a9201", "f38301882368895b9ba27df6960152d0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 3025, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.4 Safari/537.36": 9307, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 5847, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1648, "Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36 aweme_230400 JsSdk/1": 29, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 583, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1122, "Sogou web spider/4.0": 97, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 14, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 19, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 460, "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 2110, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 151, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36": 33, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 23, "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 578, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) CodeBuddyCN/1.106.1 Chrome/138.0.7204.251 Electron/37.7.0 Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 25, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 43, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 137, "YisouSpider": 9, "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 16, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot)": 5, "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 44, "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 94, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 647, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 38, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 78, "Mozilla/5.0 (Linux; Android 13; SM-A037U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 246, "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 13, "AtlasBot/1.0 (+https://atlas.harmoniamix.com/bot)": 3, "Mozilla/5.0 (compatible; ForestEngine/1.0; +https://forestengine.net/)": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.163 Safari/537.36": 109, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 69, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/149.0.0.0 Mobile/15E148 Safari/604.1": 19, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 33, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Googlebot/2.1; +http://www.google.com/bot.html) Chrome/140.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 23, "CCBot/2.0 (https://commoncrawl.org/faq/)": 1, "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 110, "Mozilla/5.0 (Linux; Android 15; SM-S938B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 7, "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)": 6, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.7390.0 Safari/537.36": 69, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1": 101, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 16, "Mozilla/5.0 (iPhone; CPU iPhone OS 15_7 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Criw/120.0.0.0 Mobile/15E148 Safari/537.36": 11, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 72, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 46, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.1.0 Safari/537.36 Edg/133.1.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.1.0 Safari/537.36 Edg/135.1.0": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 52, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 274, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.0 Safari/537.36 Edg/132.1.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.1 Safari/537.36 Edg/135.0.1": 2, "Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.175 Safari/537.36": 80, "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0": 230, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 94, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 2, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 70, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.162 Safari/537.36": 45, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.7778.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.0 Safari/537.36 Edg/132.1.0": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Bravebot/1.0; +https://search.brave.com/help/brave-search-crawler) Chrome/W.X.Y.Z Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/116.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.1.0 Safari/537.36 Edg/129.1.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 90, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (iPad; CPU OS 26_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.7727.47 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 3, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.7339.0 Safari/537.36": 49, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.1 Safari/537.36 Edg/131.0.1": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1, "Brightbot 1.0": 3, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0 Safari/537.36 Edg/134.0.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 31, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.1.0 Safari/537.36 Edg/129.1.0": 2, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.1.0 Safari/537.36 Edg/133.1.0": 2, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +claudebot@anthropic.com)": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.1 Safari/537.36 Edg/129.0.1": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 4, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@anthropic.com)": 1, "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)": 3, "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.1 Safari/537.36 Edg/129.0.1": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 129, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.1.0 Safari/537.36 Edg/129.1.0": 2, "Mozilla/5.0 (Linux; U; Android 13; zh-cn; PFCM00 Build/TP1A.220905.001) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/115.0.5790.168 Mobile Safari/537.36 HeyTapBrowser/": 2, "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)": 2, "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0 Safari/537.36 Edg/129.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)": 2, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.1 Safari/537.36 Edg/128.0.1": 4, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.5948.1368 Safari/537.36": 8, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/136.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.1 Safari/537.36 Edg/129.0.1": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (X11; CrOS x86_64 14150.87.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.124 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.googl": 33, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 YaBrowser/26.6.0.0 Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 36, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/145.0.7632.55 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 27, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 32, "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)": 4, "\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36\"": 8, "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)": 1, "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 4, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0 Safari/537.36 Edg/132.0.0": 2, "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 2, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)": 3, "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)": 1, "Mozilla/5.0 (Linux; Android 10; SM-G981A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Mobile Safari/537.36 EdgA/80.0.361.48": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 4, "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)": 2, "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.5163.1269 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0 Safari/537.36 Edg/134.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0 Safari/537.36 Edg/132.0.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.0 Safari/537.36 Edg/132.1.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/147.0.7727.15 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 1, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.1 Safari/537.36 Edg/135.0.1": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36": 50, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.1.0 Safari/537.36 Edg/133.1.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0 Safari/537.36 Edg/134.0.0": 2, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.1 Safari/537.36 Edg/131.0.1": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.1 Safari/537.36 Edg/128.0.1": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.7103.25 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0 Safari/537.36 Edg/129.0.0": 4, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 EdgA/149.0.0.0": 31, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.1 Safari/537.36 Edg/134.0.1": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 2, "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 34, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 Edg/143.0.0.0": 31, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.1 Safari/537.36 Edg/129.0.1": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)": 2, "HanaleiBot runid=beta-stage-integration-test": 7, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.1.0 Safari/537.36 Edg/128.1.0": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1518h2_8daaf6152771_6c776d3bdae5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "6c776d3bdae5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-5-17613-51764-45-51-4832-43-0-10-35-13-18-23-11-27-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789731447, "last_seen": 1789731447, "transport": "t", "ja3_hash": "fecfb53291c3ac7a73bfd997812dc746", "ja3_variant_count": 1, "ja3_variants": [ "fecfb53291c3ac7a73bfd997812dc746" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1713ht_ab0a1bf427ad_7a68ffdc4b3d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "ImageBot (research) \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "ab0a1bf427ad", "c": "7a68ffdc4b3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 79, "first_seen": 1787467739, "last_seen": 1789670121, "transport": "t", "ja3_hash": "a1ebe7f90a577e9399eaa60be3c67721", "ja3_variant_count": 2, "ja3_variants": [ "a1ebe7f90a577e9399eaa60be3c67721", "4bdac5abde98465c2a2ffd5401d73cfd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124 Safari/537.36": 17, "Open2Real-Love-Academy-Catalog/1.0 (metadata importer)": 2, "Mozilla/5.0 (compatible; wp2shell-audit/3.1)": 2, "Python-urllib/3.14": 4, "ImageBot/1.0 (compatible; research crawler; +https://github.com/rom1504/img2dataset; opt-out: abuse.notification.dcomp12b@gmail.com;": 31 }, "ua_disagreement": true } }, { "hash": "t13d190600_9c2f387b437f_82b0993b6ad8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (82b0993b6ad8) with 1 fingerprint classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d190600", "b": "9c2f387b437f", "c": "82b0993b6ad8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4871-4870-4869-4868-4865-4866-4867-49332-49333-199-198-49330-49328-49331-49329-49411-49413-49412-49414,43-10-0-11-13-51,23-24-25-29-256-4588-41,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4871, "name": "4871 (0x1307)", "known": false }, { "value": 4870, "name": "4870 (0x1306)", "known": false }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710047, "last_seen": 1788842288, "transport": "t", "ja3_hash": "21219b880ef26c2510377db4c00826f5", "ja3_variant_count": 11, "ja3_variants": [ "21219b880ef26c2510377db4c00826f5", "811ee76bda3969ee572b8518b24130e5", "4271fa2d59f87f8372dd8556b90d6b2f", "0adeb621db37ef98458c8073c3a76ecd", "0f4a63bb415896649602402180894560", "b808ec2204f311d7f305f271f078bde4", "4ce96adf70403fc18f4fcec2a74f95ad", "b754c7556ee474203f1720aec3ec1eef", "718337ca7694e38b0dbdeacff34fea1f", "a3cb62f17d6fe3e436441fff413f3797", "e4231b37295f4aee1b5e2e5236f0f13b" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1910h2_9dc949149365_466c27a6074e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "zgrab \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1910h2", "b": "9dc949149365", "c": "466c27a6074e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-5-10-11-13-65281-16-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 20, "first_seen": 1787834209, "last_seen": 1788944900, "transport": "t", "ja3_hash": "3fed133de60c35724739b913924b6c24", "ja3_variant_count": 2, "ja3_variants": [ "3fed133de60c35724739b913924b6c24", "b102b73a090f4079a02e520bc16cc6cf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/100.0.2779.56 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Internet Explorer/103.0.3155.134 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 2, "Mozilla/5.0 zgrab/0.x": 6 }, "ua_disagreement": true } }, { "hash": "t13d301000_3c43a67630b3_27f0a1fdd87d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Internet Measurement \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301000", "b": "3c43a67630b3", "c": "27f0a1fdd87d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49160-49170-10-49188-49192-49187-49191-60-61-49159-49169-5-4-4865-4866-4867,0-5-10-11-13-65281-23-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 21, "first_seen": 1787643869, "last_seen": 1789617612, "transport": "t", "ja3_hash": "26086471650ff2aef650d748b8b581b4", "ja3_variant_count": 1, "ja3_variants": [ "26086471650ff2aef650d748b8b581b4" ], "user_agents": { "Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)": 21 }, "ua_disagreement": false } }, { "hash": "t13d311000_8ae6a2f5ac15_7ef8eb972a3c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "SemrushBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311000", "b": "8ae6a2f5ac15", "c": "7ef8eb972a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-47-49196-49200-49327-49325-49195-49199-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-157-49313-49309-156-49312-49308-61-60-53-65-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 9586, "first_seen": 1787450661, "last_seen": 1789967143, "transport": "t", "ja3_hash": "e4228d1fa6f13a432e4bc5ff54841b91", "ja3_variant_count": 1, "ja3_variants": [ "e4228d1fa6f13a432e4bc5ff54841b91" ], "user_agents": { "Mozilla/5.0 (compatible; BacklinksExtendedBot)": 2, "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)": 9584 }, "ua_disagreement": false } }, { "hash": "t13d351300_bfa337485184_07030ae8cff1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "MJ12bot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d351300", "b": "bfa337485184", "c": "07030ae8cff1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-5-22-23-13-43-45-51-27,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 183, "first_seen": 1787455865, "last_seen": 1789870862, "transport": "t", "ja3_hash": "946df659d56e0ff7ee9c15561df14a6f", "ja3_variant_count": 1, "ja3_variants": [ "946df659d56e0ff7ee9c15561df14a6f" ], "user_agents": { "Mozilla/5.0 (compatible; MJ12bot/v2.0.5; http://mj12bot.com/)": 330, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; GeedoShopProductFinder) Chrome/142.0.0.0 Safari/537.36": 22 }, "ua_disagreement": true } }, { "hash": "t13d3514ht_bfa337485184_bd75118260c1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "getdomaindata \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3514ht", "b": "bfa337485184", "c": "bd75118260c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-16-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 52, "first_seen": 1787469618, "last_seen": 1789005725, "transport": "t", "ja3_hash": "5d136dad0f6eb9cc0f0b3faedb291b9a", "ja3_variant_count": 1, "ja3_variants": [ "5d136dad0f6eb9cc0f0b3faedb291b9a" ], "user_agents": { "Mozilla/5.0 (compatible; getdomaindata/1.0; +https://getdomaindata.com/bot)": 17, "MCPHarvest/0.1": 66 }, "ua_disagreement": false } }, { "hash": "t13d491300_bd868743f55c_fb34c6f268a0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Barkrowler (Babbar) \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d491300", "b": "bd868743f55c", "c": "fb34c6f268a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-5-10-11-17-23-35-13-43-45-50-51-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 569, "first_seen": 1787488906, "last_seen": 1789964899, "transport": "t", "ja3_hash": "d7a2543716f784e8de73ffe3f7f6234b", "ja3_variant_count": 1, "ja3_variants": [ "d7a2543716f784e8de73ffe3f7f6234b" ], "user_agents": { "Mozilla/5.0 (compatible; SERankingBacklinksBot/1.0; +https://seranking.com/backlinks-crawler)": 135, "Mozilla/5.0 (compatible; Barkrowler/0.9; +https://babbar.tech/crawler)": 290, "Mozilla/5.0 (compatible; IbouBot/1.0; +bot@ibou.io; +https://ibou.io/iboubot.html)": 145 }, "ua_disagreement": false } }, { "hash": "t13i030500_55b375c5d22e_fe63f8dcebdd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i030500", "b": "55b375c5d22e", "c": "fe63f8dcebdd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867,43-10-51-13-45,29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 19, "first_seen": 1787497637, "last_seen": 1789934783, "transport": "t", "ja3_hash": "d190b714adb9da7a09ec21bd4ce7fbfc", "ja3_variant_count": 1, "ja3_variants": [ "d190b714adb9da7a09ec21bd4ce7fbfc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i030700_55b375c5d22e_81ef6f8817e6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i030700", "b": "55b375c5d22e", "c": "81ef6f8817e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4866-4865-4867,5-10-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788737391, "last_seen": 1789364873, "transport": "t", "ja3_hash": "80edc6169d3210b7ba479fc100785a05", "ja3_variant_count": 1, "ja3_variants": [ "80edc6169d3210b7ba479fc100785a05" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i031000_55b375c5d22e_4a12575e92d6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i031000", "b": "55b375c5d22e", "c": "4a12575e92d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 158, "first_seen": 1787448769, "last_seen": 1789950289, "transport": "t", "ja3_hash": "4b7c9e5cd9596f4aafe940b8fc41ff89", "ja3_variant_count": 1, "ja3_variants": [ "4b7c9e5cd9596f4aafe940b8fc41ff89" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i040600_ed60d9558351_88dfcb89e28d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i040600", "b": "ed60d9558351", "c": "88dfcb89e28d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4868-4869-4867-4865,43-10-51-13-28-58,25-24-23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "curves": [ { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 64, "first_seen": 1787497670, "last_seen": 1789961361, "transport": "t", "ja3_hash": "d9bf2387fc9b4a3f9df93a296b365b60", "ja3_variant_count": 1, "ja3_variants": [ "d9bf2387fc9b4a3f9df93a296b365b60" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i040900_16476d049b0b_78f1d400d464", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i040900", "b": "16476d049b0b", "c": "78f1d400d464", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788293174, "last_seen": 1789261990, "transport": "t", "ja3_hash": "ea217b0edcd93778471552ba0b796f81", "ja3_variant_count": 1, "ja3_variants": [ "ea217b0edcd93778471552ba0b796f81" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i061000_da75d768228b_f50d94e863eb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i061000", "b": "da75d768228b", "c": "f50d94e863eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 6, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-4865-4866,11-65281-23-18-5-10-13-50-43-51,4588-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788907296, "last_seen": 1788907296, "transport": "t", "ja3_hash": "b4fb1b956ae2af8396e0787b58a35fdc", "ja3_variant_count": 1, "ja3_variants": [ "b4fb1b956ae2af8396e0787b58a35fdc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i100900_61a7ad8aa9b6_0a2341ea6ed8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i100900", "b": "61a7ad8aa9b6", "c": "0a2341ea6ed8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-51-45-43-23-10-13-5-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788629400, "last_seen": 1788685619, "transport": "t", "ja3_hash": "1fb51071f4cc44db3af98f59b88d83fa", "ja3_variant_count": 3, "ja3_variants": [ "1fb51071f4cc44db3af98f59b88d83fa", "bac9a31adf24d326224f73d5d9e5294f", "e75aa4ca740b3c8d6618197e7f332694" ], "user_agents": { "Mozilla/5.0 (compatible; ArgusScanner/0.1; +http://example/abuse)": 3 }, "ua_disagreement": false } }, { "hash": "t13i100900_61a7ad8aa9b6_36363f539193", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i100900", "b": "61a7ad8aa9b6", "c": "36363f539193", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-51-10-13-11-23-45-43-35,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 21, "first_seen": 1788629382, "last_seen": 1788685614, "transport": "t", "ja3_hash": "fd626503ea5a5d78a01ff03fb0ba75f3", "ja3_variant_count": 21, "ja3_variants": [ "fd626503ea5a5d78a01ff03fb0ba75f3", "fccaf1fdb07bf8518fb13c13b5196e5c", "14b0db80c2966c7f86c780b9dc83c8d2", "339b382146426496922404b1e008eea9", "feaed223336489b7a730a8a45df15191", "55ac31f635517b509d31857e7a01b488", "21d0f752f6d538e67b4262c3d34836b4", "7d7eb57a47f7449d85bac72b6e45eabb", "1a1806f0f1354889566efb9c8f6e3ec4", "7d96ff11c806a833a24218b3c03fb4bc", "1cd7ef077ae64faaeb90bbd518fddbf7", "3b9bd7428c696d0d8fe130bdce8e8b54" ], "user_agents": { "Mozilla/5.0 (compatible; ArgusScanner/0.1; +http://example/abuse)": 21 }, "ua_disagreement": false } }, { "hash": "t13i100900_61a7ad8aa9b6_cb8fff09048f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i100900", "b": "61a7ad8aa9b6", "c": "cb8fff09048f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-35-5-51-10-13-23-45-11,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788792964, "last_seen": 1788932620, "transport": "t", "ja3_hash": "bf5390248884b355591704f59438045e", "ja3_variant_count": 6, "ja3_variants": [ "bf5390248884b355591704f59438045e", "8c5c24dffd3f008618730f4ceac5a245", "442470ce01e218f4ac1e9ae08cf0433f", "0e830fbe30d26efe5271acd5347a5101", "0cfb752f2170450e826f929b18e7b09b", "831acf3093c90da33dcde8a7863d8ea7" ], "user_agents": { "Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)": 6 }, "ua_disagreement": false } }, { "hash": "t13i110400_47af8f603342_261fd6f5b3c3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i110400", "b": "47af8f603342", "c": "261fd6f5b3c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 11, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4867-4866-4865-52393-52392-49196-49195-49200-49199-157-156,43-10-51-13,23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 64, "first_seen": 1787497505, "last_seen": 1789961360, "transport": "t", "ja3_hash": "a4dafb4b9e44210d112ac4e7e695a007", "ja3_variant_count": 1, "ja3_variants": [ "a4dafb4b9e44210d112ac4e7e695a007" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i130500_f6a34bea2645_193c2c6852e3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i130500", "b": "f6a34bea2645", "c": "193c2c6852e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4869-4868-4865-4866-4867-49332-49333-199-198-49330-49328-49331-49329,11-43-10-13-51,23-24-25-29-256-41,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788748805, "last_seen": 1789646813, "transport": "t", "ja3_hash": "bf3372e1a919e16dea0c9fbd3e8e894a", "ja3_variant_count": 2, "ja3_variants": [ "bf3372e1a919e16dea0c9fbd3e8e894a", "af75dc975811f91028a69a9bdae90b94" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i131200_f57a46bbacb6_fb48f8b98a29", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i131200", "b": "f57a46bbacb6", "c": "fb48f8b98a29", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 12, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-35-65281-23-18-5-10-13-50-43-51-45,29-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789888743, "last_seen": 1789951691, "transport": "t", "ja3_hash": "1e4ab5fa7cf27b076ed20f64fc8fb1d9", "ja3_variant_count": 1, "ja3_variants": [ "1e4ab5fa7cf27b076ed20f64fc8fb1d9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1313ht_f57a46bbacb6_d19526659412", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "research-scan \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1313ht", "b": "f57a46bbacb6", "c": "d19526659412", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-35-65281-23-18-5-10-13-50-16-43-51-45,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788976305, "last_seen": 1788976305, "transport": "t", "ja3_hash": "e56c72ec790d5898f89528f5c080ca3b", "ja3_variant_count": 1, "ja3_variants": [ "e56c72ec790d5898f89528f5c080ca3b" ], "user_agents": { "Mozilla/5.0 (compatible; research-scan/1.0)": 5 }, "ua_disagreement": false } }, { "hash": "t13i1314ht_f57a46bbacb6_99e87a879c67", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "research-scan \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1314ht", "b": "f57a46bbacb6", "c": "99e87a879c67", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-35-65281-23-18-5-10-13-50-16-43-51-45-41,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 21, "first_seen": 1788976308, "last_seen": 1788976311, "transport": "t", "ja3_hash": "bbfe3507a810aa6c11c659bd4c7b4cbd", "ja3_variant_count": 1, "ja3_variants": [ "bbfe3507a810aa6c11c659bd4c7b4cbd" ], "user_agents": { "Mozilla/5.0 (compatible; research-scan/1.0)": 22 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_352721e01328", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "352721e01328", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789847469, "last_seen": 1789847469, "transport": "t", "ja3_hash": "14867a1012c28839263cba20c2574b02", "ja3_variant_count": 1, "ja3_variants": [ "14867a1012c28839263cba20c2574b02" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_977885baa268", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "977885baa268", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789469874, "last_seen": 1789469874, "transport": "t", "ja3_hash": "c33eddda69a19902df77f4d88d096927", "ja3_variant_count": 1, "ja3_variants": [ "c33eddda69a19902df77f4d88d096927" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_b5ff496981bd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "b5ff496981bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788445546, "last_seen": 1788840279, "transport": "t", "ja3_hash": "46b89da47adc5b34ed99707f0f528a4a", "ja3_variant_count": 1, "ja3_variants": [ "46b89da47adc5b34ed99707f0f528a4a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_014dc203c7fa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "014dc203c7fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789701012, "last_seen": 1789701012, "transport": "t", "ja3_hash": "f213b6f26417cd09e767545d5deae78d", "ja3_variant_count": 1, "ja3_variants": [ "f213b6f26417cd09e767545d5deae78d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_024997845cf4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "024997845cf4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-43-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788835365, "last_seen": 1788835365, "transport": "t", "ja3_hash": "89c0a2e3bd7cae00b0e5303f887bbf58", "ja3_variant_count": 1, "ja3_variants": [ "89c0a2e3bd7cae00b0e5303f887bbf58" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_1a3cd45dc4b9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "1a3cd45dc4b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-51-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788625008, "last_seen": 1788625008, "transport": "t", "ja3_hash": "1a1012159c5e3ec5dd0169049df2a2c7", "ja3_variant_count": 1, "ja3_variants": [ "1a1012159c5e3ec5dd0169049df2a2c7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_2eaf8a81dea6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "2eaf8a81dea6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-43-35,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789415763, "last_seen": 1789415763, "transport": "t", "ja3_hash": "f600a9fc1fbc430ea2e8eaf443297dd9", "ja3_variant_count": 1, "ja3_variants": [ "f600a9fc1fbc430ea2e8eaf443297dd9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_f51a13063a32", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "f51a13063a32", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391195, "last_seen": 1789391195, "transport": "t", "ja3_hash": "d62fd7183d2a1adfe93bb83060621e26", "ja3_variant_count": 1, "ja3_variants": [ "d62fd7183d2a1adfe93bb83060621e26" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_fd204c4683f1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "fd204c4683f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789630820, "last_seen": 1789630820, "transport": "t", "ja3_hash": "9a7ebbaa5677d5767e2c1752ab287d1e", "ja3_variant_count": 1, "ja3_variants": [ "9a7ebbaa5677d5767e2c1752ab287d1e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_087ee5c6a541", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "087ee5c6a541", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-51-13-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789617351, "last_seen": 1789617351, "transport": "t", "ja3_hash": "662a214601731887b462cbe64b38f5fc", "ja3_variant_count": 1, "ja3_variants": [ "662a214601731887b462cbe64b38f5fc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_0bcbb4cedc8b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "0bcbb4cedc8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789358144, "last_seen": 1789358144, "transport": "t", "ja3_hash": "e93a48cc8351867a77a9654c6b1dea42", "ja3_variant_count": 1, "ja3_variants": [ "e93a48cc8351867a77a9654c6b1dea42" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_2d63de5a1252", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "2d63de5a1252", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789430515, "last_seen": 1789430515, "transport": "t", "ja3_hash": "9f02fe81f414f7be891ef7f0e5b9268c", "ja3_variant_count": 1, "ja3_variants": [ "9f02fe81f414f7be891ef7f0e5b9268c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_3f0225afebbb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "3f0225afebbb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-51764-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788454351, "last_seen": 1788454351, "transport": "t", "ja3_hash": "0cf6898f3fd23459a7ab5c1cc4e35a7e", "ja3_variant_count": 1, "ja3_variants": [ "0cf6898f3fd23459a7ab5c1cc4e35a7e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_4ea34850e841", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "4ea34850e841", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-43-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789337950, "last_seen": 1789337950, "transport": "t", "ja3_hash": "bacdfce0afdabac83da79eaad289fcab", "ja3_variant_count": 1, "ja3_variants": [ "bacdfce0afdabac83da79eaad289fcab" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_5b3bb041e735", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "5b3bb041e735", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-51-11-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788491115, "last_seen": 1788491115, "transport": "t", "ja3_hash": "33bca447c6dee4191f64b87d551e4939", "ja3_variant_count": 1, "ja3_variants": [ "33bca447c6dee4191f64b87d551e4939" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_5ceb895e08fa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "5ceb895e08fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-43-10-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788777079, "last_seen": 1788777079, "transport": "t", "ja3_hash": "b775702457dbb180ff6212d187c26001", "ja3_variant_count": 1, "ja3_variants": [ "b775702457dbb180ff6212d187c26001" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_75f1a2f3e08a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "75f1a2f3e08a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-43-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789469868, "last_seen": 1789469868, "transport": "t", "ja3_hash": "123dc9de8023019d6aad8ba32949b7d0", "ja3_variant_count": 1, "ja3_variants": [ "123dc9de8023019d6aad8ba32949b7d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_83df51dd9243", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "83df51dd9243", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-65037-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789196279, "last_seen": 1789196279, "transport": "t", "ja3_hash": "487a029be4e4741054427db465937b9b", "ja3_variant_count": 1, "ja3_variants": [ "487a029be4e4741054427db465937b9b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_8b994fe5f44f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "8b994fe5f44f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-43-13-45,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789782412, "last_seen": 1789782412, "transport": "t", "ja3_hash": "adb7dcf0c095cdad9c34791b6af8f924", "ja3_variant_count": 1, "ja3_variants": [ "adb7dcf0c095cdad9c34791b6af8f924" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_a8801ff68059", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "a8801ff68059", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-18-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789654456, "last_seen": 1789654456, "transport": "t", "ja3_hash": "b7c03eaf0405d175d957fc8c099bdc91", "ja3_variant_count": 1, "ja3_variants": [ "b7c03eaf0405d175d957fc8c099bdc91" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_aafbf7ad16b0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "aafbf7ad16b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-23-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789755511, "last_seen": 1789755511, "transport": "t", "ja3_hash": "0ccd0c1401841257b6719d506190c90e", "ja3_variant_count": 1, "ja3_variants": [ "0ccd0c1401841257b6719d506190c90e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_dc3da7a2dee2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "dc3da7a2dee2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-43-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789497476, "last_seen": 1789497476, "transport": "t", "ja3_hash": "e95b4c4040592906ea223d1539695230", "ja3_variant_count": 1, "ja3_variants": [ "e95b4c4040592906ea223d1539695230" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_f24691b6ef3b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "f24691b6ef3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-5-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788496645, "last_seen": 1788496645, "transport": "t", "ja3_hash": "dbe459b96481688b695b065cea8bb7b4", "ja3_variant_count": 1, "ja3_variants": [ "dbe459b96481688b695b065cea8bb7b4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_24541ac07e51", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "24541ac07e51", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-43-51-5-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789963694, "last_seen": 1789963694, "transport": "t", "ja3_hash": "b8da25f9f71a4125c6c1f3baad0407a6", "ja3_variant_count": 1, "ja3_variants": [ "b8da25f9f71a4125c6c1f3baad0407a6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_57e8aa8bf351", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "57e8aa8bf351", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-45-43-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789295553, "last_seen": 1789295553, "transport": "t", "ja3_hash": "9f67ee4e01b019dc15771780ebeab1e3", "ja3_variant_count": 1, "ja3_variants": [ "9f67ee4e01b019dc15771780ebeab1e3" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 7 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_6916397c86d3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "6916397c86d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-65037-23-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788825895, "last_seen": 1788825895, "transport": "t", "ja3_hash": "ec32b4f9bb5a1d2ff609d3249370bbe4", "ja3_variant_count": 1, "ja3_variants": [ "ec32b4f9bb5a1d2ff609d3249370bbe4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_737ce93212c9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "737ce93212c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-10-45-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789665114, "last_seen": 1789665114, "transport": "t", "ja3_hash": "c29eee5aa63c5561d9c7d9c456eff4e1", "ja3_variant_count": 1, "ja3_variants": [ "c29eee5aa63c5561d9c7d9c456eff4e1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_8b513a83238d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "8b513a83238d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-17613-43-13-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789870126, "last_seen": 1789870126, "transport": "t", "ja3_hash": "ad9bcb725f144169109a003441ef79b4", "ja3_variant_count": 1, "ja3_variants": [ "ad9bcb725f144169109a003441ef79b4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_9b529e1c8c13", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "9b529e1c8c13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,35-27-65037-43-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789722661, "last_seen": 1789722661, "transport": "t", "ja3_hash": "8c8e53baa0e9ebf849207cf8ffed4807", "ja3_variant_count": 1, "ja3_variants": [ "8c8e53baa0e9ebf849207cf8ffed4807" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_eb1becb3acb5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "eb1becb3acb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-51-35-23-45,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789397395, "last_seen": 1789397395, "transport": "t", "ja3_hash": "8be6e5cd385df6db7b0a0e8bd71ebd79", "ja3_variant_count": 1, "ja3_variants": [ "8be6e5cd385df6db7b0a0e8bd71ebd79" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_ee2cc75a54c5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "ee2cc75a54c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-11-51-35-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788518223, "last_seen": 1788518223, "transport": "t", "ja3_hash": "861951bf99911c6abad09b919a7d12dd", "ja3_variant_count": 1, "ja3_variants": [ "861951bf99911c6abad09b919a7d12dd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_0b916f8ced88", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "0b916f8ced88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-10-65037-43-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788860642, "last_seen": 1788860642, "transport": "t", "ja3_hash": "bc7e61ba62df20dd94727586e81908b9", "ja3_variant_count": 1, "ja3_variants": [ "bc7e61ba62df20dd94727586e81908b9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_0d404127c680", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "0d404127c680", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-51-18-10-43-5,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015034, "last_seen": 1789015034, "transport": "t", "ja3_hash": "a2687bca3ea222b973d7e9d6574d1287", "ja3_variant_count": 1, "ja3_variants": [ "a2687bca3ea222b973d7e9d6574d1287" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_0eed6f2759ea", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "0eed6f2759ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-18-10-23-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789820712, "last_seen": 1789820712, "transport": "t", "ja3_hash": "047e816e7e516d32aca9c39d7cc4de05", "ja3_variant_count": 1, "ja3_variants": [ "047e816e7e516d32aca9c39d7cc4de05" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_262678d82b73", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "262678d82b73", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-43-45-23-5-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788561635, "last_seen": 1788561635, "transport": "t", "ja3_hash": "99855aface215af3dd9b333bc328fd60", "ja3_variant_count": 1, "ja3_variants": [ "99855aface215af3dd9b333bc328fd60" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_44cbd6f69c05", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "44cbd6f69c05", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-5-11-51-43-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789791007, "last_seen": 1789791007, "transport": "t", "ja3_hash": "646ad90abeff11a2407e85103851cceb", "ja3_variant_count": 1, "ja3_variants": [ "646ad90abeff11a2407e85103851cceb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_694e66345e58", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "694e66345e58", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-17613-18-51-35-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788892610, "last_seen": 1788892610, "transport": "t", "ja3_hash": "7bcfec5267d54be7394202c3b26126d7", "ja3_variant_count": 1, "ja3_variants": [ "7bcfec5267d54be7394202c3b26126d7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_7fb00560537a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "7fb00560537a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-51-35-11-43-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789669046, "last_seen": 1789669046, "transport": "t", "ja3_hash": "092fd43ce7b94d3d5334ba1ee3caca84", "ja3_variant_count": 1, "ja3_variants": [ "092fd43ce7b94d3d5334ba1ee3caca84" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_a569be63c334", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "a569be63c334", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-45-43-51764-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789579333, "last_seen": 1789579333, "transport": "t", "ja3_hash": "676c7cdc36f9b92d56bc4f20e7707014", "ja3_variant_count": 1, "ja3_variants": [ "676c7cdc36f9b92d56bc4f20e7707014" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_a688226f7e2e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "a688226f7e2e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-35-43-13-51-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788810234, "last_seen": 1788810234, "transport": "t", "ja3_hash": "e696fcc57cfdcff184c50caadc42637a", "ja3_variant_count": 1, "ja3_variants": [ "e696fcc57cfdcff184c50caadc42637a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_ab63a922c650", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "ab63a922c650", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-43-35-65281-10-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015040, "last_seen": 1789015040, "transport": "t", "ja3_hash": "c8c7ff1b9b22a0deffa2f4c8f89eb986", "ja3_variant_count": 1, "ja3_variants": [ "c8c7ff1b9b22a0deffa2f4c8f89eb986" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_cb22e3f99591", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "cb22e3f99591", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-18-13-51-10-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789515491, "last_seen": 1789515491, "transport": "t", "ja3_hash": "71e76de1d8806a4c1ba64bd905764c40", "ja3_variant_count": 1, "ja3_variants": [ "71e76de1d8806a4c1ba64bd905764c40" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_eea137bc5cb3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "eea137bc5cb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-45-35-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789662344, "last_seen": 1789662344, "transport": "t", "ja3_hash": "7cd028d9dca18da36cfaa256909096ea", "ja3_variant_count": 1, "ja3_variants": [ "7cd028d9dca18da36cfaa256909096ea" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_f67b95e75049", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "f67b95e75049", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-65037-51764-13-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789493818, "last_seen": 1789493818, "transport": "t", "ja3_hash": "446ca114bd620213e8e9da792cff7f00", "ja3_variant_count": 1, "ja3_variants": [ "446ca114bd620213e8e9da792cff7f00" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_ff8b92ca574d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "ff8b92ca574d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-10-43-35-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789116949, "last_seen": 1789116949, "transport": "t", "ja3_hash": "98007378db8f7733798426757300614f", "ja3_variant_count": 1, "ja3_variants": [ "98007378db8f7733798426757300614f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507ht_8daaf6152771_262678d82b73", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (262678d82b73) with 1 fingerprint classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13i1507ht", "b": "8daaf6152771", "c": "262678d82b73", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-10-43-23-45-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789451924, "last_seen": 1789451924, "transport": "t", "ja3_hash": "2b4464762a7918600a27d3f30fb85f05", "ja3_variant_count": 1, "ja3_variants": [ "2b4464762a7918600a27d3f30fb85f05" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13i150800_8daaf6152771_13a1f6b27a4d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "13a1f6b27a4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-27-13-5-43-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789444997, "last_seen": 1789444997, "transport": "t", "ja3_hash": "54710e5b954570663dfcf8b238c469a4", "ja3_variant_count": 1, "ja3_variants": [ "54710e5b954570663dfcf8b238c469a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_177b6afa48b5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "177b6afa48b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-23-11-17613-27-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788552955, "last_seen": 1788552955, "transport": "t", "ja3_hash": "824b7a06ff472f9adfdc67012c8aaaf2", "ja3_variant_count": 1, "ja3_variants": [ "824b7a06ff472f9adfdc67012c8aaaf2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_2bacb20dfd6c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "2bacb20dfd6c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-11-17613-27-65037-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789455642, "last_seen": 1789455642, "transport": "t", "ja3_hash": "3935c58f63f97f80348731a90509104d", "ja3_variant_count": 1, "ja3_variants": [ "3935c58f63f97f80348731a90509104d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_43d4d4b42f45", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "43d4d4b42f45", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-27-65037-17613-13-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469872, "last_seen": 1789469872, "transport": "t", "ja3_hash": "97852bc566a6a52c149dc78ff4e29a2e", "ja3_variant_count": 1, "ja3_variants": [ "97852bc566a6a52c149dc78ff4e29a2e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_507f3bd29586", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "507f3bd29586", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-45-17613-13-43-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789909638, "last_seen": 1789909638, "transport": "t", "ja3_hash": "45f9fe8c03c3dccbf3d466232545fb8b", "ja3_variant_count": 1, "ja3_variants": [ "45f9fe8c03c3dccbf3d466232545fb8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_6745f3898eba", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "6745f3898eba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-5-43-65281-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789658278, "last_seen": 1789658278, "transport": "t", "ja3_hash": "95faebf4f627c023ccc88a03b3e9b205", "ja3_variant_count": 1, "ja3_variants": [ "95faebf4f627c023ccc88a03b3e9b205" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_b4c25dbffb3c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "b4c25dbffb3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-5-65281-18-35-10-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789770102, "last_seen": 1789770102, "transport": "t", "ja3_hash": "5b4953ed85c99366175805eb2b4fa810", "ja3_variant_count": 1, "ja3_variants": [ "5b4953ed85c99366175805eb2b4fa810" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_c78cc01db1ce", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "c78cc01db1ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-23-18-43-10-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788871687, "last_seen": 1788871687, "transport": "t", "ja3_hash": "b9add12e1afcb3cd708d5ef0c6e949eb", "ja3_variant_count": 1, "ja3_variants": [ "b9add12e1afcb3cd708d5ef0c6e949eb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_cca35195692c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "cca35195692c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-43-11-27-35-23-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789689009, "last_seen": 1789689009, "transport": "t", "ja3_hash": "643fbc630070120ab0acf1530cf4a138", "ja3_variant_count": 1, "ja3_variants": [ "643fbc630070120ab0acf1530cf4a138" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_f786dc852690", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "f786dc852690", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-11-45-43-18-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789949208, "last_seen": 1789949208, "transport": "t", "ja3_hash": "f98c38c2f195fa36a7a9a95bb11bdbf6", "ja3_variant_count": 1, "ja3_variants": [ "f98c38c2f195fa36a7a9a95bb11bdbf6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_f9d859529e45", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "f9d859529e45", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-23-18-45-27-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789673883, "last_seen": 1789673883, "transport": "t", "ja3_hash": "7da89be6ca7c2595f438803c92444a29", "ja3_variant_count": 1, "ja3_variants": [ "7da89be6ca7c2595f438803c92444a29" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_095b7077c040", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "095b7077c040", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-65281-11-27-65037-17613-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788858760, "last_seen": 1788858760, "transport": "t", "ja3_hash": "4974b180859d4d65fed9717ee85c90c0", "ja3_variant_count": 1, "ja3_variants": [ "4974b180859d4d65fed9717ee85c90c0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_2bef1ac9a94b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "2bef1ac9a94b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-43-35-5-13-45-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789214142, "last_seen": 1789214142, "transport": "t", "ja3_hash": "f4cf1212f960ac982b5ac9072a93b689", "ja3_variant_count": 1, "ja3_variants": [ "f4cf1212f960ac982b5ac9072a93b689" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_47bbbe33d51d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "47bbbe33d51d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-13-43-10-45-17613-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788825896, "last_seen": 1788825896, "transport": "t", "ja3_hash": "f7acd63c460a7312ad2d3d5c9e578b45", "ja3_variant_count": 1, "ja3_variants": [ "f7acd63c460a7312ad2d3d5c9e578b45" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_4d5f9a936b5b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "4d5f9a936b5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-45-10-18-5-65281-51-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789398570, "last_seen": 1789398570, "transport": "t", "ja3_hash": "35a703025486f03702f7263a6c93938a", "ja3_variant_count": 1, "ja3_variants": [ "35a703025486f03702f7263a6c93938a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_4f88bd8d0072", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "4f88bd8d0072", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-43-45-51-18-23-10-17613,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789358140, "last_seen": 1789358140, "transport": "t", "ja3_hash": "a3655de9493f62be05b7b27de68c5383", "ja3_variant_count": 1, "ja3_variants": [ "a3655de9493f62be05b7b27de68c5383" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_5289a9c24e92", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "5289a9c24e92", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-65037-35-13-18-45-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789544583, "last_seen": 1789544583, "transport": "t", "ja3_hash": "30ca97c9d9e12f811624fba8770b71a5", "ja3_variant_count": 1, "ja3_variants": [ "30ca97c9d9e12f811624fba8770b71a5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_6add871e60e7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "6add871e60e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-35-65281-11-45-17613-43-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789543666, "last_seen": 1789543666, "transport": "t", "ja3_hash": "8c9f92c052d87f9d9bf73402a80427f6", "ja3_variant_count": 1, "ja3_variants": [ "8c9f92c052d87f9d9bf73402a80427f6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_9796d8a9404c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "9796d8a9404c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-18-43-27-65281-10-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789153470, "last_seen": 1789153470, "transport": "t", "ja3_hash": "d2dcd425c7ecdd85bcc083f6fdf54005", "ja3_variant_count": 1, "ja3_variants": [ "d2dcd425c7ecdd85bcc083f6fdf54005" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_a8d251cf0c2d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "a8d251cf0c2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-11-27-51-23-43-17613-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789461365, "last_seen": 1789461365, "transport": "t", "ja3_hash": "635cc3d4f4cf33d89d494848bd81063d", "ja3_variant_count": 1, "ja3_variants": [ "635cc3d4f4cf33d89d494848bd81063d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_ac2b489252dd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "ac2b489252dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,4832-65281-18-51-17613-27-43-45-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788725825, "last_seen": 1788725825, "transport": "t", "ja3_hash": "8533f0fa18fef887d93c650b696095f9", "ja3_variant_count": 1, "ja3_variants": [ "8533f0fa18fef887d93c650b696095f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_4aea5e4e991b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "4aea5e4e991b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-23-45-11-5-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788924652, "last_seen": 1788924652, "transport": "t", "ja3_hash": "cd01f705c50bda6352d74922e65d6cb0", "ja3_variant_count": 1, "ja3_variants": [ "cd01f705c50bda6352d74922e65d6cb0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_7fa6f18f0afd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "7fa6f18f0afd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65037-18-43-45-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789870497, "last_seen": 1789870497, "transport": "t", "ja3_hash": "0d1e4d6d4815db1c88ae7c9467ea15a7", "ja3_variant_count": 1, "ja3_variants": [ "0d1e4d6d4815db1c88ae7c9467ea15a7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_980b585a698f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "980b585a698f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-27-45-65037-16-5-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788563597, "last_seen": 1788563597, "transport": "t", "ja3_hash": "50eded5181f9e0c054b764fe378311dd", "ja3_variant_count": 1, "ja3_variants": [ "50eded5181f9e0c054b764fe378311dd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_0fdad728a578", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "0fdad728a578", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-65281-27-10-23-5-18-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789267512, "last_seen": 1789267512, "transport": "t", "ja3_hash": "43d47ea28b077f9bf78259fe10bf7d95", "ja3_variant_count": 1, "ja3_variants": [ "43d47ea28b077f9bf78259fe10bf7d95" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_216356b62aef", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "216356b62aef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-18-17613-10-13-65281-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789040431, "last_seen": 1789040431, "transport": "t", "ja3_hash": "f47f020ed16a809aed3bb9639c25adf5", "ja3_variant_count": 1, "ja3_variants": [ "f47f020ed16a809aed3bb9639c25adf5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_296898b1edfe", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "296898b1edfe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-27-17613-65281-18-51-43-35-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788934505, "last_seen": 1788934505, "transport": "t", "ja3_hash": "12ee3117598372ef254c9c591134c31e", "ja3_variant_count": 1, "ja3_variants": [ "12ee3117598372ef254c9c591134c31e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_899307a7dd32", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "899307a7dd32", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-11-43-13-35-65037-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789665112, "last_seen": 1789665112, "transport": "t", "ja3_hash": "27eef50cc718a9184c9d06869f6b6bf6", "ja3_variant_count": 1, "ja3_variants": [ "27eef50cc718a9184c9d06869f6b6bf6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_9b5b5423d701", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "9b5b5423d701", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-27-11-5-65037-35-17613-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789439013, "last_seen": 1789439013, "transport": "t", "ja3_hash": "d8399038208f86619a435b02cdc4cc37", "ja3_variant_count": 1, "ja3_variants": [ "d8399038208f86619a435b02cdc4cc37" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_bb2c11f9118d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "bb2c11f9118d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-51-45-65281-27-23-43-5-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789592011, "last_seen": 1789592011, "transport": "t", "ja3_hash": "8ee521eb85f1792325297cc16144a5fa", "ja3_variant_count": 1, "ja3_variants": [ "8ee521eb85f1792325297cc16144a5fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_19b37005f41d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "19b37005f41d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-5-51764-65037-35-10-43-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788711053, "last_seen": 1788711053, "transport": "t", "ja3_hash": "f25114760fa9fb100515fae90e6a5710", "ja3_variant_count": 1, "ja3_variants": [ "f25114760fa9fb100515fae90e6a5710" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_7ca7d55a8b4b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "7ca7d55a8b4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51764-10-65037-45-11-43-13-17613-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789381772, "last_seen": 1789381772, "transport": "t", "ja3_hash": "3f2dfe09eced865e91cbc60b064badf7", "ja3_variant_count": 1, "ja3_variants": [ "3f2dfe09eced865e91cbc60b064badf7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_b0f6f14d21c3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "b0f6f14d21c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-27-65281-10-18-45-23-17613-5-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788696694, "last_seen": 1788696694, "transport": "t", "ja3_hash": "e714be6fb02f8f27d1f6fe7db97dba64", "ja3_variant_count": 1, "ja3_variants": [ "e714be6fb02f8f27d1f6fe7db97dba64" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_b1299265fb1f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "b1299265fb1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-10-27-13-43-17613-11-18-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788663680, "last_seen": 1788663680, "transport": "t", "ja3_hash": "a524cd7cdf8338acd08ded50271c4c04", "ja3_variant_count": 1, "ja3_variants": [ "a524cd7cdf8338acd08ded50271c4c04" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_d420e4aed517", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "d420e4aed517", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-27-35-43-17613-13-18-23-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788656436, "last_seen": 1788656436, "transport": "t", "ja3_hash": "6efc09cd362c5ac184a1db1e4705e691", "ja3_variant_count": 1, "ja3_variants": [ "6efc09cd362c5ac184a1db1e4705e691" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_16fcb5c37e5a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "16fcb5c37e5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-10-5-23-65281-18-43-17613-45-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788515282, "last_seen": 1788515282, "transport": "t", "ja3_hash": "aa24b1d78660b959160ee6c17f652ed3", "ja3_variant_count": 1, "ja3_variants": [ "aa24b1d78660b959160ee6c17f652ed3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_193dc55611d3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "193dc55611d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-35-51764-5-45-65281-43-11-13-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788711051, "last_seen": 1788711051, "transport": "t", "ja3_hash": "0306d439d8444becc3646761ad8f3eae", "ja3_variant_count": 1, "ja3_variants": [ "0306d439d8444becc3646761ad8f3eae" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_1e42e07f4f9a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "1e42e07f4f9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-43-18-27-13-17613-10-35-23-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789463341, "last_seen": 1789463341, "transport": "t", "ja3_hash": "f88cb8dc21dd76d12747b1b61e9d02c5", "ja3_variant_count": 1, "ja3_variants": [ "f88cb8dc21dd76d12747b1b61e9d02c5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_20f4ea61072b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "20f4ea61072b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-65281-10-43-5-51764-45-18-65037-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788900185, "last_seen": 1788900185, "transport": "t", "ja3_hash": "2cd5c849bc1ede5043b63864c5e65688", "ja3_variant_count": 1, "ja3_variants": [ "2cd5c849bc1ede5043b63864c5e65688" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_329403cb162f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "329403cb162f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-43-23-13-17613-65037-51764-5-45-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789728399, "last_seen": 1789728399, "transport": "t", "ja3_hash": "63d1b30410f289e6be6a83d7c4d643b8", "ja3_variant_count": 1, "ja3_variants": [ "63d1b30410f289e6be6a83d7c4d643b8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_3aa542035edf", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "3aa542035edf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-23-35-18-43-51764-65037-17613-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788903846, "last_seen": 1788903846, "transport": "t", "ja3_hash": "d6f6172e4dde4e7a3aa5562018f821f6", "ja3_variant_count": 1, "ja3_variants": [ "d6f6172e4dde4e7a3aa5562018f821f6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_53b6007cfcd6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "53b6007cfcd6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-65037-43-45-65281-13-18-10-17613-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789658274, "last_seen": 1789658274, "transport": "t", "ja3_hash": "ce0bd5397de06ce65728363f0f3530ac", "ja3_variant_count": 1, "ja3_variants": [ "ce0bd5397de06ce65728363f0f3530ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_66038f602303", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "66038f602303", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-65281-27-17613-43-45-10-18-5-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789430929, "last_seen": 1789430929, "transport": "t", "ja3_hash": "c2012d6379a28fd64a888bc4a3671532", "ja3_variant_count": 1, "ja3_variants": [ "c2012d6379a28fd64a888bc4a3671532" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_b17293c4b46f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "b17293c4b46f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-43-18-35-65037-65281-51764-27-10-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789736896, "last_seen": 1789736896, "transport": "t", "ja3_hash": "042d0c6f46e0aef985205d25d99733ba", "ja3_variant_count": 1, "ja3_variants": [ "042d0c6f46e0aef985205d25d99733ba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_ec6b4befa3cd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "ec6b4befa3cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-65037-16-43-13-5-45-27-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789755490, "last_seen": 1789755490, "transport": "t", "ja3_hash": "44ec144ecc8f99f37a8db176e85036e9", "ja3_variant_count": 1, "ja3_variants": [ "44ec144ecc8f99f37a8db176e85036e9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_556db6a3b758", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "556db6a3b758", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-18-65281-43-10-11-35-65037-45-27-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788934410, "last_seen": 1788934410, "transport": "t", "ja3_hash": "6a29c94302f366d179b092cabeef7f8e", "ja3_variant_count": 1, "ja3_variants": [ "6a29c94302f366d179b092cabeef7f8e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_b93ce70e6b67", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "b93ce70e6b67", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-45-5-35-23-17613-11-18-65281-65037-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788866549, "last_seen": 1788866549, "transport": "t", "ja3_hash": "1b834f288b74eee87f138813d15d3caa", "ja3_variant_count": 1, "ja3_variants": [ "1b834f288b74eee87f138813d15d3caa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_20058ac78caa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "20058ac78caa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-13-65281-16-17613-11-65037-10-45-18-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789949159, "last_seen": 1789949159, "transport": "t", "ja3_hash": "982891af18f700d5bee1a1edeaa4ca20", "ja3_variant_count": 1, "ja3_variants": [ "982891af18f700d5bee1a1edeaa4ca20" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151400_8daaf6152771_12517a9a6ccc", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151400", "b": "8daaf6152771", "c": "12517a9a6ccc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-23-65281-11-65037-35-5-17613-43-10-45-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789569085, "last_seen": 1789569085, "transport": "t", "ja3_hash": "d6720a4fcff395c1faabce69e5a87130", "ja3_variant_count": 1, "ja3_variants": [ "d6720a4fcff395c1faabce69e5a87130" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151500_8daaf6152771_33f857a189cb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151500", "b": "8daaf6152771", "c": "33f857a189cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-43-11-45-65037-10-13-5-17613-65281-23-27-35-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789736896, "last_seen": 1789736896, "transport": "t", "ja3_hash": "3b326687bef3a78f90a532c89fa7e1c2", "ja3_variant_count": 1, "ja3_variants": [ "3b326687bef3a78f90a532c89fa7e1c2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i170900_5b57614c22b0_78e6aca7449b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i170900", "b": "5b57614c22b0", "c": "78e6aca7449b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,23-65281-10-11-35-13-51-45-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 46, "first_seen": 1787468376, "last_seen": 1789788154, "transport": "t", "ja3_hash": "052a5e65c3a64e860e1706b1de3c46a9", "ja3_variant_count": 3, "ja3_variants": [ "052a5e65c3a64e860e1706b1de3c46a9", "7041540a5e44ce9a1d4200c4214355aa", "10a627ad22b67741a3319a1d42cbf0a6" ], "user_agents": { "libredtail-http": 658 }, "ua_disagreement": false } }, { "hash": "t13i171100_ab0a1bf427ad_ecd0401ec68b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i171100", "b": "ab0a1bf427ad", "c": "ecd0401ec68b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825503, "last_seen": 1789615155, "transport": "t", "ja3_hash": "1987606153939a4c0ccc1465ecf8e431", "ja3_variant_count": 1, "ja3_variants": [ "1987606153939a4c0ccc1465ecf8e431" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i180900_85036bcba153_1f22a2ca17c4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i180900", "b": "85036bcba153", "c": "1f22a2ca17c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787560229, "last_seen": 1789374174, "transport": "t", "ja3_hash": "bf88702d3fed3795dbe0118835cc4229", "ja3_variant_count": 1, "ja3_variants": [ "bf88702d3fed3795dbe0118835cc4229" ], "user_agents": { "Mozilla/5.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i190500_9c2f387b437f_05020bd715f8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i190500", "b": "9c2f387b437f", "c": "05020bd715f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4871-4870-4869-4868-4865-4866-4867-49332-49333-199-198-49330-49328-49331-49329-49411-49413-49412-49414,11-10-43-13-51,23-24-25-29-256-4588-41,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4871, "name": "4871 (0x1307)", "known": false }, { "value": 4870, "name": "4870 (0x1306)", "known": false }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787820563, "last_seen": 1789485425, "transport": "t", "ja3_hash": "c797a5d216f09ffb7f293a413929012a", "ja3_variant_count": 1, "ja3_variants": [ "c797a5d216f09ffb7f293a413929012a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i190800_9dc949149365_97f8aa674fd9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Censys \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i190800", "b": "9dc949149365", "c": "97f8aa674fd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 8, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 723, "first_seen": 1787451885, "last_seen": 1789965756, "transport": "t", "ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "ja3_variant_count": 6, "ja3_variants": [ "35fa0a83e466acbec1cfbb9016d550ab", "19e29534fd49dd27d09234e639c4057e", "e873803ab6f54f1316b295ee4fbea1d2", "f6b1f1a5591b53aa4d6b4a8de8e50ce6", "f72589e607f9b36992b6b437ce399f26", "89be98bbd4f065fe510fca4893cf8d9b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 81, "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)": 259, "Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)": 11, "Mozilla/5.0 (Linux; Android 9; moto x4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; U; Android 8.1.0; es-us; Redmi Note 5 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/71.0.3578.141 Mobile Safari/537.36 XiaoMi": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4 240.111 Safari/537.36": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0": 6, "l9explore/1.2.2": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13i191100_9dc949149365_9249cab70c77", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i191100", "b": "9dc949149365", "c": "9249cab70c77", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-35-13-65281-23-18-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788585573, "last_seen": 1789653032, "transport": "t", "ja3_hash": "30ae8660657b7198d6f11ae92ef04b28", "ja3_variant_count": 1, "ja3_variants": [ "30ae8660657b7198d6f11ae92ef04b28" ], "user_agents": { "CGrab/v8.12.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i220900_231e334592e8_29829a46703f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i220900", "b": "231e334592e8", "c": "29829a46703f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 22, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,43-13-35-10-51-49-23-65281-45,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788840790, "last_seen": 1789336128, "transport": "t", "ja3_hash": "622a7fd6adbafa3736c1a3468db8a8e0", "ja3_variant_count": 1, "ja3_variants": [ "622a7fd6adbafa3736c1a3468db8a8e0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i260800_3309cf098094_97f8aa674fd9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i260800", "b": "3309cf098094", "c": "97f8aa674fd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 26, "extension_count": 8, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49161-158-52392-52394-51-61-22-49162-57-49171-10-49172-156-157-47-53-49170-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787847004, "last_seen": 1789881201, "transport": "t", "ja3_hash": "3429560be8f9b1b5aa346694eb419bad", "ja3_variant_count": 1, "ja3_variants": [ "3429560be8f9b1b5aa346694eb419bad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i270800_fa4239e4ca25_97f8aa674fd9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i270800", "b": "fa4239e4ca25", "c": "97f8aa674fd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 27, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49199-49200-49195-49196-52392-52393-49171-49161-49172-49162-156-157-47-53-49170-10-50-19-56-64-102-106-162-163-4865-4867-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789267533, "last_seen": 1789267533, "transport": "t", "ja3_hash": "c0098facaec57f7a5692a6130526a733", "ja3_variant_count": 1, "ja3_variants": [ "c0098facaec57f7a5692a6130526a733" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i300900_3c43a67630b3_e7c285222651", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Internet Measurement \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i300900", "b": "3c43a67630b3", "c": "e7c285222651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49160-49170-10-49188-49192-49187-49191-60-61-49159-49169-5-4-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 98, "first_seen": 1787497502, "last_seen": 1789944396, "transport": "t", "ja3_hash": "7024ed8c0d80542d17159473f564b551", "ja3_variant_count": 1, "ja3_variants": [ "7024ed8c0d80542d17159473f564b551" ], "user_agents": { "Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)": 38 }, "ua_disagreement": false } }, { "hash": "t13i301100_1d37bd780c83_ecd0401ec68b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i301100", "b": "1d37bd780c83", "c": "ecd0401ec68b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788976824, "last_seen": 1789855326, "transport": "t", "ja3_hash": "2617ff3a2d7f879546f0aac7afc5f15c", "ja3_variant_count": 1, "ja3_variants": [ "2617ff3a2d7f879546f0aac7afc5f15c" ], "user_agents": { "zern-scanner (+https://zern.io)": 2, "Mozilla/5.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i310900_e8f1e7e78f70_1f22a2ca17c4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i310900", "b": "e8f1e7e78f70", "c": "1f22a2ca17c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788459250, "last_seen": 1789751531, "transport": "t", "ja3_hash": "c216e752cae6f8755fd27f561d031636", "ja3_variant_count": 1, "ja3_variants": [ "c216e752cae6f8755fd27f561d031636" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i310900_e8f1e7e78f70_5ac7197df9d2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i310900", "b": "e8f1e7e78f70", "c": "5ac7197df9d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 14, "first_seen": 1787697745, "last_seen": 1789425139, "transport": "t", "ja3_hash": "c34a54599a1fbaf1786aa6d633545a60", "ja3_variant_count": 1, "ja3_variants": [ "c34a54599a1fbaf1786aa6d633545a60" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i311100_1d947a95fc68_7e1102d2036b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i311100", "b": "1d947a95fc68", "c": "7e1102d2036b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788771242, "last_seen": 1788782100, "transport": "t", "ja3_hash": "ea0154154790b24e85b5cc9676622c9c", "ja3_variant_count": 1, "ja3_variants": [ "ea0154154790b24e85b5cc9676622c9c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i311100_e8f1e7e78f70_0d7ed806c34c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i311100", "b": "e8f1e7e78f70", "c": "0d7ed806c34c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-158-49188-49192-49187-49191-107-103-49162-49172-49161-49171-57-51-157-156-61-60-53-47-255,5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789290642, "last_seen": 1789290642, "transport": "t", "ja3_hash": "65ce4cb3186abc297a488bacf38b8d6a", "ja3_variant_count": 1, "ja3_variants": [ "65ce4cb3186abc297a488bacf38b8d6a" ], "user_agents": { "Mozilla/5.0 (compatible; ips-agent)": 3 }, "ua_disagreement": false } }, { "hash": "t13i360900_bcee18a5b459_3550537cd59b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i360900", "b": "bcee18a5b459", "c": "3550537cd59b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 36, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49188-49192-49162-49172-49311-107-57-49324-49187-49191-49161-49171-49310-103-51-157-156-49309-49308-61-60-53-47,65281-11-10-22-23-13-43-45-51,4588-4587-4590-29-23-30-24-25-41-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4590, "name": "4590 (0x11ee)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788718236, "last_seen": 1788718236, "transport": "t", "ja3_hash": "16ad1af652b89865590482c2db861013", "ja3_variant_count": 1, "ja3_variants": [ "16ad1af652b89865590482c2db861013" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2)": 1 }, "ua_disagreement": false } }, { "hash": "t13i491100_bd868743f55c_7c76daad20ec", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i491100", "b": "bd868743f55c", "c": "7c76daad20ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 49, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788710036, "last_seen": 1789027736, "transport": "t", "ja3_hash": "57900674e6344e6daca60641dfd512dd", "ja3_variant_count": 1, "ja3_variants": [ "57900674e6344e6daca60641dfd512dd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i681000_13e0e9e1c501_8e6e362c5eac", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "nmap \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i681000", "b": "13e0e9e1c501", "c": "8e6e362c5eac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 68, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-132-65,65281-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1026, "first_seen": 1787813795, "last_seen": 1789799413, "transport": "t", "ja3_hash": "f37fb2137dc72687f85fa3bdcfd9ebdf", "ja3_variant_count": 1, "ja3_variants": [ "f37fb2137dc72687f85fa3bdcfd9ebdf" ], "user_agents": { "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)": 100, "iPhoto/9.1.1 (Macintosh; N; PPC)": 1 }, "ua_disagreement": false } }, { "hash": "t13i711100_8f28d1f76561_ecd0401ec68b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "nmap \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i711100", "b": "8f28d1f76561", "c": "ecd0401ec68b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 71, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-154-153-69-68-157-49309-49233-156-49308-49232-61-192-60-186-132-150-65,65281-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 47, "first_seen": 1788920368, "last_seen": 1789773534, "transport": "t", "ja3_hash": "745c078278cdc062a615392c6bdf086c", "ja3_variant_count": 1, "ja3_variants": [ "745c078278cdc062a615392c6bdf086c" ], "user_agents": { "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)": 4 }, "ua_disagreement": false } }, { "hash": "t13i751000_479067518aa3_d41ae481755e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i751000", "b": "479067518aa3", "c": "d41ae481755e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 75, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-132-65-255,11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 210, "first_seen": 1788459221, "last_seen": 1789751531, "transport": "t", "ja3_hash": "327efd8a5e8ed9fa2b145f126b748661", "ja3_variant_count": 1, "ja3_variants": [ "327efd8a5e8ed9fa2b145f126b748661" ], "user_agents": { "Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)": 24 }, "ua_disagreement": false } }, { "hash": "t13i781000_ab95583b6d39_d41ae481755e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i781000", "b": "ab95583b6d39", "c": "d41ae481755e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 78, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-154-153-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-132-150-65-255,11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 13, "first_seen": 1789150608, "last_seen": 1789703691, "transport": "t", "ja3_hash": "b3e88a126e6e0179ae465227a52f60ad", "ja3_variant_count": 1, "ja3_variants": [ "b3e88a126e6e0179ae465227a52f60ad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i781100_ab95583b6d39_ccd0985badbe", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i781100", "b": "ab95583b6d39", "c": "ccd0985badbe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 78, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-154-153-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-132-150-65-255,11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 316, "first_seen": 1787940134, "last_seen": 1789812959, "transport": "t", "ja3_hash": "414440b3366abba75e5380623974d98d", "ja3_variant_count": 1, "ja3_variants": [ "414440b3366abba75e5380623974d98d" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_2) AppleWebKit/605.1.15 (KHTML": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML": 8 }, "ua_disagreement": false } }, { "hash": "t13i911100_0d5420ba6086_87b33ccefea8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i911100", "b": "0d5420ba6086", "c": "87b33ccefea8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 91, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-150-65-255,11-10-35-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788648420, "last_seen": 1788648420, "transport": "t", "ja3_hash": "da472575d3ad6f060581fbbad76c09d6", "ja3_variant_count": 1, "ja3_variants": [ "da472575d3ad6f060581fbbad76c09d6" ], "user_agents": { "Python-urllib/3.13": 1 }, "ua_disagreement": false } }, { "hash": "t13i920900_1a0666d6c920_71f3a2441023", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i920900", "b": "1a0666d6c920", "c": "71f3a2441023", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 92, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-150-65-7-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788120502, "last_seen": 1789305702, "transport": "t", "ja3_hash": "2b78e6fc15e004a7c23166a124473e83", "ja3_variant_count": 1, "ja3_variants": [ "2b78e6fc15e004a7c23166a124473e83" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i970900_21fe6ccd8ec5_5fb67df6121e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i970900", "b": "21fe6ccd8ec5", "c": "5fb67df6121e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 97, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-49196-49200-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49235-167-49195-49199-158-49326-49324-49314-49310-49244-49248-49234-166-49188-49192-107-49267-49271-196-109-197-49187-49191-103-49266-49270-190-108-191-49162-49172-57-136-49177-58-137-49161-49171-51-154-69-49176-52-155-70-49159-49169-49174-49160-49170-22-49175-27-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-150-65-7-5-10-49158-49168-49173-59-2-1-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788756961, "last_seen": 1789850328, "transport": "t", "ja3_hash": "a943bbc58359ce7d3dc5b42f209aaa5b", "ja3_variant_count": 1, "ja3_variants": [ "a943bbc58359ce7d3dc5b42f209aaa5b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i990900_760e5dff8384_5ac7197df9d2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i990900", "b": "760e5dff8384", "c": "5ac7197df9d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 99, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-167-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-166-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-150-65-7-49158-49168-49173-59-2-1-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 29, "first_seen": 1787614670, "last_seen": 1789915444, "transport": "t", "ja3_hash": "effe96911320528dfdfdba040c9e915b", "ja3_variant_count": 1, "ja3_variants": [ "effe96911320528dfdfdba040c9e915b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 19 }, "ua_disagreement": false } }, { "hash": "q13d0115h3_0f2cb44170f4_e9b4b416271b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0115h3", "b": "0f2cb44170f4", "c": "e9b4b416271b", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865,11-16-13-57-45-23-0-10-18-43-5-65281-35-51-41,24-23-25-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789480534, "last_seen": 1789480534, "transport": "q", "ja3_hash": "ed94997f17c737b4bdb7745213143169", "ja3_variant_count": 1, "ja3_variants": [ "ed94997f17c737b4bdb7745213143169" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0115h3_0f2cb44170f4_fb190d169104", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0115h3", "b": "0f2cb44170f4", "c": "fb190d169104", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865,11-45-16-50-23-10-57-65281-5-51-18-0-13-43-35,25-24-23-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789323994, "last_seen": 1789710033, "transport": "q", "ja3_hash": "207fbd2687764bb2e2aeb5040c3eea42", "ja3_variant_count": 2, "ja3_variants": [ "207fbd2687764bb2e2aeb5040c3eea42", "c7b1082b9ce4dfbb4b13928a059239df" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0116h3_0f2cb44170f4_df815552bcbf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0116h3", "b": "0f2cb44170f4", "c": "df815552bcbf", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 16, "alpn": "h3" } }, "ja3_string": "771,4865,65281-13-11-45-10-57-16-50-35-0-18-51-23-43-5-41,23-24-29-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788631471, "last_seen": 1788631471, "transport": "q", "ja3_hash": "6ae2ccb40fa29cf04e4b48a2fb9b5716", "ja3_variant_count": 1, "ja3_variants": [ "6ae2ccb40fa29cf04e4b48a2fb9b5716" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0215h3_62ed6f6ca7ad_fb190d169104", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0215h3", "b": "62ed6f6ca7ad", "c": "fb190d169104", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4866,18-10-43-51-57-13-45-16-0-65281-5-23-50-11-35,24-29-25-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788735252, "last_seen": 1788735252, "transport": "q", "ja3_hash": "34021e3c39c4224580b6a3b544dbbecf", "ja3_variant_count": 1, "ja3_variants": [ "34021e3c39c4224580b6a3b544dbbecf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0215h3_fffbd61365f3_fb190d169104", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0215h3", "b": "fffbd61365f3", "c": "fb190d169104", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4866-4867,13-50-35-11-43-45-57-23-10-65281-18-51-5-0-16,23-25-29-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788796620, "last_seen": 1788796620, "transport": "q", "ja3_hash": "4fa9ff5071fb8ec417b649ad526e6e95", "ja3_variant_count": 1, "ja3_variants": [ "4fa9ff5071fb8ec417b649ad526e6e95" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0307h3_55b375c5d22e_945b2dc88d6b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0307h3", "b": "55b375c5d22e", "c": "945b2dc88d6b", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 7, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,51-43-13-10-0-16-57,23-24-29-30,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true } ], "point_formats": [] }, "observed": { "count": 14, "first_seen": 1789268963, "last_seen": 1789411016, "transport": "q", "ja3_hash": "121f6e4f22ee3205214b0676ed64b9e2", "ja3_variant_count": 1, "ja3_variants": [ "121f6e4f22ee3205214b0676ed64b9e2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0308h3_55b375c5d22e_10107d85556e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0308h3", "b": "55b375c5d22e", "c": "10107d85556e", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 8, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,51-43-13-10-45-0-16-57,23-24-29-30,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789313888, "last_seen": 1789411015, "transport": "q", "ja3_hash": "273162b4249b4a9e8e66cf971794f989", "ja3_variant_count": 1, "ja3_variants": [ "273162b4249b4a9e8e66cf971794f989" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0308h3_55b375c5d22e_9a370787d3dd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "q13d0308h3", "b": "55b375c5d22e", "c": "9a370787d3dd", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 8, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-10-16-13-51-45-43-57,4588-65074-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 65074, "name": "65074 (0xfe32)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789673244, "last_seen": 1789673244, "transport": "q", "ja3_hash": "b6b6dae0a68dd7441a579b3ea9d8465e", "ja3_variant_count": 1, "ja3_variants": [ "b6b6dae0a68dd7441a579b3ea9d8465e" ], "user_agents": { "quiche": 1 }, "ua_disagreement": false } }, { "hash": "q13d0308h3_55b375c5d22e_d2b5c8c7ba45", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0308h3", "b": "55b375c5d22e", "c": "d2b5c8c7ba45", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 8, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-10-16-13-51-45-43-57,29-23-4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789386544, "last_seen": 1789630818, "transport": "q", "ja3_hash": "376aa2c82d54a586fb5b3aee27996152", "ja3_variant_count": 1, "ja3_variants": [ "376aa2c82d54a586fb5b3aee27996152" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0310h3_55b375c5d22e_6da5d9173cfb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0310h3", "b": "55b375c5d22e", "c": "6da5d9173cfb", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 10, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,57-13-43-10-0-16-51-45-27-17613,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 11, "first_seen": 1789268794, "last_seen": 1789271380, "transport": "q", "ja3_hash": "69d67176b9e408cfb0aa49a6e81cbf52", "ja3_variant_count": 11, "ja3_variants": [ "69d67176b9e408cfb0aa49a6e81cbf52", "d502d3f4859a5916daf9ca1f625ce3a8", "4e26c7e2b29cb501ce86bc055d3eda11", "dcc2d36031cfc8f1758dec50cf4dbba5", "275c834bc7c0031d298aecfa910c79b1", "bb3b67225f7a87185108b048e35eac8d", "bfc03ebb14860d45c31fac28af7269e8", "634a67cd8d11152117274a45e2daaa48", "48050d6543b1c707f7db5953f4b0d811", "a43dbc8b1fa728fc6781aac91565525a", "1413848ee6f2fbf0486a84dd156b937f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_35002cbdedc5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "35002cbdedc5", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,45-23-51-43-0-16-13-10-5-11-57,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3422, "first_seen": 1787458763, "last_seen": 1789897248, "transport": "q", "ja3_hash": "e5713f9fa5f2c6759cc2fe7a8ac4f959", "ja3_variant_count": 3265, "ja3_variants": [ "e5713f9fa5f2c6759cc2fe7a8ac4f959", "58ae2af42be784b11b153012567c7aaa", "93ee95fe6b9d8c001c72ffb9d949d1ff", "0a1056565eb4623104925050b063227e", "d7cf9f33073f166f87012703a08e4b29", "5068653c3390d5b2f0a392204ad1c664", "6b92be722c5d65ba1746d0c7408a7c57", "ed1ccaa4c660ad7ca2ae001fa52c714f", "59cba859875e7e36cc7820459e1f3ec4", "b1de8a288cde8657cbbd3a2f54e4cce9", "a548554ffbdf612adc0d4db4cc962671", "4a6ccda8d30a874a21ca7f71ced3848d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_4a886e84af51", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "4a886e84af51", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865,13-5-45-11-23-10-57-16-43-0-51,4588-24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788717957, "last_seen": 1789044913, "transport": "q", "ja3_hash": "225310debf2ca53d4f23af55e60f2951", "ja3_variant_count": 6, "ja3_variants": [ "225310debf2ca53d4f23af55e60f2951", "46723ed1dcb15e7fbc8e6acc7fb1d5c8", "3aa56531f857632c86af3152a972833c", "54007567f06b17fb14fba6134dee9705", "068bd8fb8c3e080bf5f6a7caabf0efbe", "857ad827e3433b7ea28167e0974b8f2f" ], "user_agents": { "h3-get/1.0 (quinn+h3)": 6 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_512ac2397e4d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "512ac2397e4d", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,43-45-51-5-16-10-57-13-23-0-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789409529, "last_seen": 1789409534, "transport": "q", "ja3_hash": "02cc4cf10938f7cbd351ca53ed7feb08", "ja3_variant_count": 4, "ja3_variants": [ "02cc4cf10938f7cbd351ca53ed7feb08", "681b907e6c9604225330e665c113666a", "41cef7a8978b8e28193858ca3bd9ca11", "502bf5b39d2cf14bf0b3fa8a9d23d5a2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_03c564151835", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "03c564151835", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,28-10-23-5-45-65281-16-0-43-13-51-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 28, "name": "record_size_limit", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789674075, "last_seen": 1789674075, "transport": "q", "ja3_hash": "aff0224d4ace77b6c5c1993fcb890bc9", "ja3_variant_count": 1, "ja3_variants": [ "aff0224d4ace77b6c5c1993fcb890bc9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_0fd97f318465", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "0fd97f318465", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,28-65281-16-10-51-5-0-13-45-43-23-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789674054, "last_seen": 1789674054, "transport": "q", "ja3_hash": "93207077c783dfdfbe153963170e6d79", "ja3_variant_count": 1, "ja3_variants": [ "93207077c783dfdfbe153963170e6d79" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_21ef1e544c18", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "21ef1e544c18", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,13-43-10-51-16-23-5-45-28-0-65281-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789674032, "last_seen": 1789674032, "transport": "q", "ja3_hash": "5e134a8abae98b9ed57ae35c0c90b51b", "ja3_variant_count": 1, "ja3_variants": [ "5e134a8abae98b9ed57ae35c0c90b51b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_2fbbe4786686", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "2fbbe4786686", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,13-16-43-28-10-23-0-45-51-65281-5-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789674069, "last_seen": 1789674069, "transport": "q", "ja3_hash": "b105e3296f6e7058ad7da27e483dcfea", "ja3_variant_count": 1, "ja3_variants": [ "b105e3296f6e7058ad7da27e483dcfea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_5063bf5cc8ea", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "5063bf5cc8ea", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,28-65281-23-51-16-10-43-45-5-13-0-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789674045, "last_seen": 1789674045, "transport": "q", "ja3_hash": "e9c165be96586d1f3c2e5bc7f5a9fd79", "ja3_variant_count": 1, "ja3_variants": [ "e9c165be96586d1f3c2e5bc7f5a9fd79" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_5c0a0aff5045", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "5c0a0aff5045", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,10-28-0-43-13-65281-45-51-23-5-16-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789674046, "last_seen": 1789674046, "transport": "q", "ja3_hash": "239ab21396136149bbef6b24763f8beb", "ja3_variant_count": 1, "ja3_variants": [ "239ab21396136149bbef6b24763f8beb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_d3a2dad44cbf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "d3a2dad44cbf", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865,5-13-0-11-45-43-16-10-51-23-27-57,4588-24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789951999, "last_seen": 1789957171, "transport": "q", "ja3_hash": "91f334d9149a1e9c87f218bd57e17f44", "ja3_variant_count": 4, "ja3_variants": [ "91f334d9149a1e9c87f218bd57e17f44", "e8e671fe10b262114e8c02e38bc0fce6", "110143432547bffb3b094bc2a8c10fc9", "6c8f80d63074a27381ea65c4151467a8" ], "user_agents": { "h3-get/1.0 (quinn+h3)": 4 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_52fae87ca051", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "52fae87ca051", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4867-4865-4866,0-11-35-65281-23-18-57-5-10-13-16-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789471623, "last_seen": 1789471623, "transport": "q", "ja3_hash": "9dae6088474d3b70e1c2f8eb6f036ba7", "ja3_variant_count": 1, "ja3_variants": [ "9dae6088474d3b70e1c2f8eb6f036ba7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_fb190d169104", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "fb190d169104", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-11-35-65281-23-18-57-5-10-13-50-16-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789074989, "last_seen": 1789652932, "transport": "q", "ja3_hash": "ab76c5da7688915188a5547503fae3a4", "ja3_variant_count": 1, "ja3_variants": [ "ab76c5da7688915188a5547503fae3a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0316h3_55b375c5d22e_df815552bcbf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0316h3", "b": "55b375c5d22e", "c": "df815552bcbf", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 16, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865,13-11-45-50-35-10-0-65281-43-23-18-51-5-16-57-41,25-24-29-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789428280, "last_seen": 1789428280, "transport": "q", "ja3_hash": "4f2d1d0345558f14b8f7af32f1fbc0aa", "ja3_variant_count": 1, "ja3_variants": [ "4f2d1d0345558f14b8f7af32f1fbc0aa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0412h3_16476d049b0b_a05e41356250", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0412h3", "b": "16476d049b0b", "c": "a05e41356250", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865-255,0-11-10-35-16-22-23-13-43-45-51-57,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787848421, "last_seen": 1789043713, "transport": "q", "ja3_hash": "f16c52428297f68b25d61e4736136bfd", "ja3_variant_count": 1, "ja3_variants": [ "f16c52428297f68b25d61e4736136bfd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t00d1410h2_45de795eb070_4a1f08c76dc1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t00d1410h2", "b": "45de795eb070", "c": "4a1f08c76dc1", "properties": { "transport": "TCP", "tls_version": "unknown (00)", "sni": "server name sent", "cipher_count": 14, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-47-53-10,65281-0-5-10-11-13-35-16-43-51,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787509868, "last_seen": 1789900804, "transport": "t", "ja3_hash": "67396c305af5e84832bb07769a12f207", "ja3_variant_count": 1, "ja3_variants": [ "67396c305af5e84832bb07769a12f207" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t00d1610h2_46e7e9700bed_34c01d0633e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t00d1610h2", "b": "46e7e9700bed", "c": "34c01d0633e5", "properties": { "transport": "TCP", "tls_version": "unknown (00)", "sni": "server name sent", "cipher_count": 16, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-5-10-11-13-35-16-43-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 105, "first_seen": 1787509869, "last_seen": 1789900803, "transport": "t", "ja3_hash": "83e21bd49603155f1719db1dea0c5b08", "ja3_variant_count": 1, "ja3_variants": [ "83e21bd49603155f1719db1dea0c5b08" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t00d310700_e8f1e7e78f70_285959464749", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t00d310700", "b": "e8f1e7e78f70", "c": "285959464749", "properties": { "transport": "TCP", "tls_version": "unknown (00)", "sni": "server name sent", "cipher_count": 31, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-4866-4867-4865-61-60-53-47-255,0-10-11-13-35-43-51,29-23-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787509863, "last_seen": 1789900805, "transport": "t", "ja3_hash": "d6c8d13a0de5ede7a96e587c0b79f76e", "ja3_variant_count": 1, "ja3_variants": [ "d6c8d13a0de5ede7a96e587c0b79f76e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_0c65036c8509_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "0c65036c8509", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,58-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615166, "transport": "t", "ja3_hash": "dbb5e49d5f0b4ec420015c0b929ddf55", "ja3_variant_count": 1, "ja3_variants": [ "dbb5e49d5f0b4ec420015c0b929ddf55" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_0f5bc959ae24_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "0f5bc959ae24", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,108-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615164, "transport": "t", "ja3_hash": "88fd03a54ca4b67d36544818782c71a0", "ja3_variant_count": 1, "ja3_variants": [ "88fd03a54ca4b67d36544818782c71a0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_0fb537d8e144_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "0fb537d8e144", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,103-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615166, "transport": "t", "ja3_hash": "c024761f33cab17b6029cbb4dbf3d4b6", "ja3_variant_count": 1, "ja3_variants": [ "c024761f33cab17b6029cbb4dbf3d4b6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_1275cc1ca538_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "1275cc1ca538", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,3-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615162, "transport": "t", "ja3_hash": "7052beb8f24998e7d758fbc84cd8bdec", "ja3_variant_count": 1, "ja3_variants": [ "7052beb8f24998e7d758fbc84cd8bdec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_14422b46a244_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "14422b46a244", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,9-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615162, "transport": "t", "ja3_hash": "f83fabb33790db4723420f62f6639704", "ja3_variant_count": 1, "ja3_variants": [ "f83fabb33790db4723420f62f6639704" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_185cab9fea21_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "185cab9fea21", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,1-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615170, "transport": "t", "ja3_hash": "9798429e1639e73604c908855db75538", "ja3_variant_count": 1, "ja3_variants": [ "9798429e1639e73604c908855db75538" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_1c0a52334b2c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "1c0a52334b2c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,48-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615162, "transport": "t", "ja3_hash": "689cf81f981f31f440fd4a25b42f4759", "ja3_variant_count": 1, "ja3_variants": [ "689cf81f981f31f440fd4a25b42f4759" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_1c131e13d449_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "1c131e13d449", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,15-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615165, "transport": "t", "ja3_hash": "bad50a2359e4908f9334d9925b612b52", "ja3_variant_count": 1, "ja3_variants": [ "bad50a2359e4908f9334d9925b612b52" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_1f3ccb6b5971_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "1f3ccb6b5971", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,62-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615167, "transport": "t", "ja3_hash": "2d5f0882658b0390c5d96df92e5cac5e", "ja3_variant_count": 1, "ja3_variants": [ "2d5f0882658b0390c5d96df92e5cac5e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_224f5cbaaa26_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "224f5cbaaa26", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,61-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615166, "transport": "t", "ja3_hash": "88c546be8f00dd9d881d4abcf88b518a", "ja3_variant_count": 1, "ja3_variants": [ "88c546be8f00dd9d881d4abcf88b518a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_23061ef215d6_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "23061ef215d6", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,137-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825520, "last_seen": 1789615170, "transport": "t", "ja3_hash": "5f52ecd43bf0cc9d5fccfc16819f8cc0", "ja3_variant_count": 1, "ja3_variants": [ "5f52ecd43bf0cc9d5fccfc16819f8cc0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_23358192d48b_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "23358192d48b", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,106-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615166, "transport": "t", "ja3_hash": "850e42ecb25c6856d92f0a30a82231ba", "ja3_variant_count": 1, "ja3_variants": [ "850e42ecb25c6856d92f0a30a82231ba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_2858a708d91c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "2858a708d91c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615166, "transport": "t", "ja3_hash": "d45db1e555e664b28c3a3900fd04aed9", "ja3_variant_count": 1, "ja3_variants": [ "d45db1e555e664b28c3a3900fd04aed9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_2c202acb5b0d_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "2c202acb5b0d", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,154-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615166, "transport": "t", "ja3_hash": "efbca12efb0f5826516e44c42de90a8d", "ja3_variant_count": 1, "ja3_variants": [ "efbca12efb0f5826516e44c42de90a8d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_2de5af831e68_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "2de5af831e68", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,65-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615168, "transport": "t", "ja3_hash": "60eb856690358aa6f94938cf8995adf2", "ja3_variant_count": 1, "ja3_variants": [ "60eb856690358aa6f94938cf8995adf2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_30605b3abcde_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "30605b3abcde", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,17-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615165, "transport": "t", "ja3_hash": "8b266a965ae92265903bdfa8c3f29944", "ja3_variant_count": 1, "ja3_variants": [ "8b266a965ae92265903bdfa8c3f29944" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_35db378cb09f_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "35db378cb09f", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,51-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615167, "transport": "t", "ja3_hash": "d28a8101c4338a36818026d638344da9", "ja3_variant_count": 1, "ja3_variants": [ "d28a8101c4338a36818026d638344da9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_375aaf1d63fe_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "375aaf1d63fe", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,162-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615167, "transport": "t", "ja3_hash": "b16d1a41250b90b3be2eb25bf69ac0e7", "ja3_variant_count": 1, "ja3_variants": [ "b16d1a41250b90b3be2eb25bf69ac0e7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_3c8714487106_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "3c8714487106", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,16-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615167, "transport": "t", "ja3_hash": "ef1dfc23e0b62a95ddf39f9f35295aa2", "ja3_variant_count": 1, "ja3_variants": [ "ef1dfc23e0b62a95ddf39f9f35295aa2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_3f56bb683bdc_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "3f56bb683bdc", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,20-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615167, "transport": "t", "ja3_hash": "86f3e36086e48a193f9bf6d8b11c2a3e", "ja3_variant_count": 1, "ja3_variants": [ "86f3e36086e48a193f9bf6d8b11c2a3e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_3fede5d533e3_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "3fede5d533e3", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,167-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615172, "transport": "t", "ja3_hash": "b753971a60e3c979a7f44af444f7a5bf", "ja3_variant_count": 1, "ja3_variants": [ "b753971a60e3c979a7f44af444f7a5bf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_437c38fb20d7_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "437c38fb20d7", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,55-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615166, "transport": "t", "ja3_hash": "fdd28255cc4bd40aad30f3a62366b325", "ja3_variant_count": 1, "ja3_variants": [ "fdd28255cc4bd40aad30f3a62366b325" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_462ecd6708d4_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "462ecd6708d4", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,27-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615168, "transport": "t", "ja3_hash": "d1be6a741fe45a95e51cd6b5607a9107", "ja3_variant_count": 1, "ja3_variants": [ "d1be6a741fe45a95e51cd6b5607a9107" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_484ebc7627f0_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "484ebc7627f0", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,56-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615165, "transport": "t", "ja3_hash": "1879512bf003517b407e1989a620490d", "ja3_variant_count": 1, "ja3_variants": [ "1879512bf003517b407e1989a620490d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_4a513bce9f12_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "4a513bce9f12", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,68-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615164, "transport": "t", "ja3_hash": "3c385bd605eb8e2bb8ffe22dddb88353", "ja3_variant_count": 1, "ja3_variants": [ "3c385bd605eb8e2bb8ffe22dddb88353" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_515ebe86e7c3_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "515ebe86e7c3", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615166, "transport": "t", "ja3_hash": "5287a67572f32f7bd389d2afb13ecd1d", "ja3_variant_count": 1, "ja3_variants": [ "5287a67572f32f7bd389d2afb13ecd1d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_5470a87bf7fc_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "5470a87bf7fc", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,164-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615167, "transport": "t", "ja3_hash": "fbf678f3b3e2f383f7478481e12d8439", "ja3_variant_count": 1, "ja3_variants": [ "fbf678f3b3e2f383f7478481e12d8439" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_57c1461cef57_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "57c1461cef57", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,161-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615165, "transport": "t", "ja3_hash": "38d90b1af937f98a23fdc4c066274210", "ja3_variant_count": 1, "ja3_variants": [ "38d90b1af937f98a23fdc4c066274210" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_593aba79ccba_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "593aba79ccba", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,18-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615164, "transport": "t", "ja3_hash": "e622cd02200f7eca34d42d20dfbfae98", "ja3_variant_count": 1, "ja3_variants": [ "e622cd02200f7eca34d42d20dfbfae98" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_5bb0eb0ba27c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "5bb0eb0ba27c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,159-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615165, "transport": "t", "ja3_hash": "4b0b89161f20552ab7ddb64c5bb64656", "ja3_variant_count": 1, "ja3_variants": [ "4b0b89161f20552ab7ddb64c5bb64656" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_6376cb8fadaa_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "6376cb8fadaa", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,57-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615165, "transport": "t", "ja3_hash": "4dd7882fe610d6272493ea3c1e0a97b5", "ja3_variant_count": 1, "ja3_variants": [ "4dd7882fe610d6272493ea3c1e0a97b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_671e0306a5cb_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "671e0306a5cb", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,19-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1787825511, "last_seen": 1788877101, "transport": "t", "ja3_hash": "f7e6ecbf3a2de96d1f1efffa0e71a5ac", "ja3_variant_count": 1, "ja3_variants": [ "f7e6ecbf3a2de96d1f1efffa0e71a5ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_69d181a99895_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "69d181a99895", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,152-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615169, "transport": "t", "ja3_hash": "287fdff6400f043c055048c289c3b8f7", "ja3_variant_count": 1, "ja3_variants": [ "287fdff6400f043c055048c289c3b8f7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_69d68bc28b42_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "69d68bc28b42", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,59-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615169, "transport": "t", "ja3_hash": "f7dbf74e48adeb303bd3987bd3a7b513", "ja3_variant_count": 1, "ja3_variants": [ "f7dbf74e48adeb303bd3987bd3a7b513" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_6d6b3751bd69_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "6d6b3751bd69", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,153-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615164, "transport": "t", "ja3_hash": "6b98eb99d5371121061a2e2bbd47ce4d", "ja3_variant_count": 1, "ja3_variants": [ "6b98eb99d5371121061a2e2bbd47ce4d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_72fe80e83b5d_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "72fe80e83b5d", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,13-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615166, "transport": "t", "ja3_hash": "9e3b1ffb36b835ba2898427a71484fab", "ja3_variant_count": 1, "ja3_variants": [ "9e3b1ffb36b835ba2898427a71484fab" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_798dd72d0aaa_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "798dd72d0aaa", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,156-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615167, "transport": "t", "ja3_hash": "43da1875ea8f38b926478566262bf2f8", "ja3_variant_count": 1, "ja3_variants": [ "43da1875ea8f38b926478566262bf2f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_7ba938555a01_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "7ba938555a01", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,25-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615168, "transport": "t", "ja3_hash": "4f370bd8182a102bb610bce201c278f3", "ja3_variant_count": 1, "ja3_variants": [ "4f370bd8182a102bb610bce201c278f3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_85064055552b_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "85064055552b", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,151-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615170, "transport": "t", "ja3_hash": "b4966046a927978e5759d0a49c9df4d8", "ja3_variant_count": 1, "ja3_variants": [ "b4966046a927978e5759d0a49c9df4d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_86ae22adfd52_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "86ae22adfd52", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,52-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615167, "transport": "t", "ja3_hash": "a27310ee12a0b9be693acaa32679bcc8", "ja3_variant_count": 1, "ja3_variants": [ "a27310ee12a0b9be693acaa32679bcc8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_8764e5090277_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "8764e5090277", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,135-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615169, "transport": "t", "ja3_hash": "c75bc38ad8b853d36d382665b5c416ce", "ja3_variant_count": 1, "ja3_variants": [ "c75bc38ad8b853d36d382665b5c416ce" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_8cde4933ab6b_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "8cde4933ab6b", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,26-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615168, "transport": "t", "ja3_hash": "d80826d3b55b8202d9216d9fdf6f51ce", "ja3_variant_count": 1, "ja3_variants": [ "d80826d3b55b8202d9216d9fdf6f51ce" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_8d2fb8454607_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "8d2fb8454607", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,70-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615164, "transport": "t", "ja3_hash": "b03cf1a5e6d1382d85c3970d5461830f", "ja3_variant_count": 1, "ja3_variants": [ "b03cf1a5e6d1382d85c3970d5461830f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_9cb11800989c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "9cb11800989c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,155-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615164, "transport": "t", "ja3_hash": "4fe7ade1aca7106b5210602afb27fb05", "ja3_variant_count": 1, "ja3_variants": [ "4fe7ade1aca7106b5210602afb27fb05" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_9d31ef4cc8d3_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "9d31ef4cc8d3", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,63-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615162, "transport": "t", "ja3_hash": "aa45772c2fb13a67c3df862f655b0e06", "ja3_variant_count": 1, "ja3_variants": [ "aa45772c2fb13a67c3df862f655b0e06" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_a047181052cf_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "a047181052cf", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,157-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615168, "transport": "t", "ja3_hash": "18ecbeac768a2d9b81f14430ece82f66", "ja3_variant_count": 1, "ja3_variants": [ "18ecbeac768a2d9b81f14430ece82f66" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_a0f473027383_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "a0f473027383", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,2-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615167, "transport": "t", "ja3_hash": "b2fe92249ad5e66e89a0209e559da621", "ja3_variant_count": 1, "ja3_variants": [ "b2fe92249ad5e66e89a0209e559da621" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_a146388b8b2c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "a146388b8b2c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,64-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615166, "transport": "t", "ja3_hash": "d2e5be33b50a592bdb71ddf365e281f5", "ja3_variant_count": 1, "ja3_variants": [ "d2e5be33b50a592bdb71ddf365e281f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_a25efb179806_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "a25efb179806", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,158-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615164, "transport": "t", "ja3_hash": "502e6ebf9a83f2271ab1d4091062f6fd", "ja3_variant_count": 1, "ja3_variants": [ "502e6ebf9a83f2271ab1d4091062f6fd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_a5878986a7c9_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "a5878986a7c9", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,47-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615168, "transport": "t", "ja3_hash": "4d94c8ba390c333eddcaf438b4db10f4", "ja3_variant_count": 1, "ja3_variants": [ "4d94c8ba390c333eddcaf438b4db10f4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_a8d286a27066_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "a8d286a27066", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,23-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615168, "transport": "t", "ja3_hash": "a8feae49ee6281b9c2580502f948d9e2", "ja3_variant_count": 1, "ja3_variants": [ "a8feae49ee6281b9c2580502f948d9e2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_af3458fd17af_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "af3458fd17af", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,160-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615169, "transport": "t", "ja3_hash": "e3937fc47bd5b5a21850e3214775c7f9", "ja3_variant_count": 1, "ja3_variants": [ "e3937fc47bd5b5a21850e3214775c7f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_b0ed54973b0f_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "b0ed54973b0f", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,50-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615169, "transport": "t", "ja3_hash": "b96e79496d80fd04c55dfa3ec20e9969", "ja3_variant_count": 1, "ja3_variants": [ "b96e79496d80fd04c55dfa3ec20e9969" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_bae431c474f8_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "bae431c474f8", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,66-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615165, "transport": "t", "ja3_hash": "63609c6be82c6a50ce90312af834dd2c", "ja3_variant_count": 1, "ja3_variants": [ "63609c6be82c6a50ce90312af834dd2c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_c259c416e32c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "c259c416e32c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,12-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615165, "transport": "t", "ja3_hash": "c02eff9dd2e6e6d8aaaa120ac9e9d55c", "ja3_variant_count": 1, "ja3_variants": [ "c02eff9dd2e6e6d8aaaa120ac9e9d55c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_c3df0a865ad8_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "c3df0a865ad8", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,150-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615167, "transport": "t", "ja3_hash": "168eb90a848dc57608565ed62b0c704b", "ja3_variant_count": 1, "ja3_variants": [ "168eb90a848dc57608565ed62b0c704b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_c6933f2ed6ed_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "c6933f2ed6ed", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,107-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825521, "last_seen": 1789615171, "transport": "t", "ja3_hash": "5151d22d3333d48bcb204f8775bed4fd", "ja3_variant_count": 1, "ja3_variants": [ "5151d22d3333d48bcb204f8775bed4fd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_c9fe23a5d87c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "c9fe23a5d87c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,67-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615169, "transport": "t", "ja3_hash": "1f576eca6e82ff7dfc542e00367e74d8", "ja3_variant_count": 1, "ja3_variants": [ "1f576eca6e82ff7dfc542e00367e74d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_cfa6b5cae2b1_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "cfa6b5cae2b1", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,105-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615165, "transport": "t", "ja3_hash": "ae33eda3e0a3d80c9f30dcc6e862b287", "ja3_variant_count": 1, "ja3_variants": [ "ae33eda3e0a3d80c9f30dcc6e862b287" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_d25758f9cc88_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "d25758f9cc88", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,24-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615165, "transport": "t", "ja3_hash": "841435cc9e9f75ff9eef5b18f8da2253", "ja3_variant_count": 1, "ja3_variants": [ "841435cc9e9f75ff9eef5b18f8da2253" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_d30dd38cd76f_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "d30dd38cd76f", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,60-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615166, "transport": "t", "ja3_hash": "b106a5f2af0b7063305f94908cc38d73", "ja3_variant_count": 1, "ja3_variants": [ "b106a5f2af0b7063305f94908cc38d73" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_d83d06a7b5eb_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "d83d06a7b5eb", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,134-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615169, "transport": "t", "ja3_hash": "7aece20cd7373396270ee8f994de9053", "ja3_variant_count": 1, "ja3_variants": [ "7aece20cd7373396270ee8f994de9053" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_d99cf322fdea_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "d99cf322fdea", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,133-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615167, "transport": "t", "ja3_hash": "712d80a66eec8ceed7ccbe7d34bbd998", "ja3_variant_count": 1, "ja3_variants": [ "712d80a66eec8ceed7ccbe7d34bbd998" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_da5e85b893fc_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "da5e85b893fc", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,10-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615166, "transport": "t", "ja3_hash": "a10c9f69df03cc1ddf32eecbf859cafd", "ja3_variant_count": 1, "ja3_variants": [ "a10c9f69df03cc1ddf32eecbf859cafd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_e03107c9d76e_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "e03107c9d76e", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,5-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615165, "transport": "t", "ja3_hash": "6c4102c083d186ffae0aa91e5a5cb84a", "ja3_variant_count": 1, "ja3_variants": [ "6c4102c083d186ffae0aa91e5a5cb84a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_e530588400b6_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "e530588400b6", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,132-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615168, "transport": "t", "ja3_hash": "2135383dc01528c4206edd5ae908141a", "ja3_variant_count": 1, "ja3_variants": [ "2135383dc01528c4206edd5ae908141a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_e93a3df64476_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "e93a3df64476", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,165-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615167, "transport": "t", "ja3_hash": "a0491407cdb6d4377aa724fd8a0073bb", "ja3_variant_count": 1, "ja3_variants": [ "a0491407cdb6d4377aa724fd8a0073bb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_ea1f27bcdcc2_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "ea1f27bcdcc2", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,136-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615164, "transport": "t", "ja3_hash": "789d8f82ee375bfcf064e2d3e4501e29", "ja3_variant_count": 1, "ja3_variants": [ "789d8f82ee375bfcf064e2d3e4501e29" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_ed19d00bad77_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "ed19d00bad77", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,21-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615168, "transport": "t", "ja3_hash": "11294effe7c5c53ab09d829fdfa420e8", "ja3_variant_count": 1, "ja3_variants": [ "11294effe7c5c53ab09d829fdfa420e8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_ee2968deacb9_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "ee2968deacb9", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,109-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615167, "transport": "t", "ja3_hash": "7ad55b8beb1ddd0fca8b689ac29f3ab1", "ja3_variant_count": 1, "ja3_variants": [ "7ad55b8beb1ddd0fca8b689ac29f3ab1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_eea8af79bad9_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "eea8af79bad9", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,69-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615163, "transport": "t", "ja3_hash": "8079dce8093e68028004ea8e9496e575", "ja3_variant_count": 1, "ja3_variants": [ "8079dce8093e68028004ea8e9496e575" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_f2d8273d9564_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "f2d8273d9564", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,53-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615161, "transport": "t", "ja3_hash": "762b4d00c25395bfd6a2c28f91895201", "ja3_variant_count": 1, "ja3_variants": [ "762b4d00c25395bfd6a2c28f91895201" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_f37a1d878fe1_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "f37a1d878fe1", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,163-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615168, "transport": "t", "ja3_hash": "7c60c7d4909345fdd0c116463fae09a4", "ja3_variant_count": 1, "ja3_variants": [ "7c60c7d4909345fdd0c116463fae09a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_f4b95c39a23e_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "f4b95c39a23e", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,6-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615163, "transport": "t", "ja3_hash": "74317fd8b68f306c581dfbdb67381dfc", "ja3_variant_count": 1, "ja3_variants": [ "74317fd8b68f306c581dfbdb67381dfc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_fa20206d2144_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "fa20206d2144", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,7-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615168, "transport": "t", "ja3_hash": "e9b073ec3a2cd8edf25a2d27cf2adc47", "ja3_variant_count": 1, "ja3_variants": [ "e9b073ec3a2cd8edf25a2d27cf2adc47" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_fb1e6c9f8d32_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "fb1e6c9f8d32", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,104-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615167, "transport": "t", "ja3_hash": "6a856656b0a825504d48120ecc51d565", "ja3_variant_count": 1, "ja3_variants": [ "6a856656b0a825504d48120ecc51d565" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_fb765c19c5ff_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "fb765c19c5ff", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,166-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615166, "transport": "t", "ja3_hash": "6169d31cbf720d41b5cd5b51e733aa3c", "ja3_variant_count": 1, "ja3_variants": [ "6169d31cbf720d41b5cd5b51e733aa3c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_fbc32bd69299_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "fbc32bd69299", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,8-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615169, "transport": "t", "ja3_hash": "7863a4b7e53f72a3cb1c2c04c0eb8da0", "ja3_variant_count": 1, "ja3_variants": [ "7863a4b7e53f72a3cb1c2c04c0eb8da0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_fd2d85721aa5_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "fd2d85721aa5", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,54-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615167, "transport": "t", "ja3_hash": "94755c3e6b7309af2623107f01e97047", "ja3_variant_count": 1, "ja3_variants": [ "94755c3e6b7309af2623107f01e97047" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_017f96aa3752_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "017f96aa3752", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,190-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615167, "transport": "t", "ja3_hash": "06e3b5be4842e2b32e52b9897ce3dabb", "ja3_variant_count": 1, "ja3_variants": [ "06e3b5be4842e2b32e52b9897ce3dabb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_1846c2936b89_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "1846c2936b89", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49238-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615163, "transport": "t", "ja3_hash": "0c513d31f77685e28648f01ab4f0fee0", "ja3_variant_count": 1, "ja3_variants": [ "0c513d31f77685e28648f01ab4f0fee0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_20953c10fd1e_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "20953c10fd1e", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49308-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615166, "transport": "t", "ja3_hash": "0e77fd66725eb9942fd4cf0dfb997afd", "ja3_variant_count": 1, "ja3_variants": [ "0e77fd66725eb9942fd4cf0dfb997afd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_257973278e6d_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "257973278e6d", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,195-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615165, "transport": "t", "ja3_hash": "60222250ac0a849c745bfd24d56ad246", "ja3_variant_count": 1, "ja3_variants": [ "60222250ac0a849c745bfd24d56ad246" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_2901e63b1132_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "2901e63b1132", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49234-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615167, "transport": "t", "ja3_hash": "e44f47710ef14fad994a5131ab2cbd7d", "ja3_variant_count": 1, "ja3_variants": [ "e44f47710ef14fad994a5131ab2cbd7d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_311fb8e5b694_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "311fb8e5b694", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49239-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615167, "transport": "t", "ja3_hash": "a3a1228246b0e4623d78b3ea12ebc084", "ja3_variant_count": 1, "ja3_variants": [ "a3a1228246b0e4623d78b3ea12ebc084" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_3d40e48a2282_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "3d40e48a2282", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,52394-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615168, "transport": "t", "ja3_hash": "3698e747925284c16566276949837449", "ja3_variant_count": 1, "ja3_variants": [ "3698e747925284c16566276949837449" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_3f35d2254949_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "3f35d2254949", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,186-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615165, "transport": "t", "ja3_hash": "eaa812c4822096b7be4717f668f74f27", "ja3_variant_count": 1, "ja3_variants": [ "eaa812c4822096b7be4717f668f74f27" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_40046a45f286_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "40046a45f286", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49232-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615167, "transport": "t", "ja3_hash": "e8174c448ea3017edc171bc6b69e5522", "ja3_variant_count": 1, "ja3_variants": [ "e8174c448ea3017edc171bc6b69e5522" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_532f5318fa2e_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "532f5318fa2e", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,192-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615165, "transport": "t", "ja3_hash": "8dc48039b62da5baa61e1c647776730c", "ja3_variant_count": 1, "ja3_variants": [ "8dc48039b62da5baa61e1c647776730c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_5550d68fda30_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "5550d68fda30", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49312-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615167, "transport": "t", "ja3_hash": "914f0d9aa871bdbac9a7ddef780059d8", "ja3_variant_count": 1, "ja3_variants": [ "914f0d9aa871bdbac9a7ddef780059d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_5e7453b33de5_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "5e7453b33de5", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49235-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615173, "transport": "t", "ja3_hash": "ba5df0763cea3b05862dc45b1c3da77c", "ja3_variant_count": 1, "ja3_variants": [ "ba5df0763cea3b05862dc45b1c3da77c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_671e0306a5cb_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "671e0306a5cb", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,19-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789615166, "last_seen": 1789615166, "transport": "t", "ja3_hash": "fe66b478e7814483fd0129c7b08024af", "ja3_variant_count": 1, "ja3_variants": [ "fe66b478e7814483fd0129c7b08024af" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_69403f293a54_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "69403f293a54", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49233-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615162, "transport": "t", "ja3_hash": "451de572098740e5fc35b2048527d926", "ja3_variant_count": 1, "ja3_variants": [ "451de572098740e5fc35b2048527d926" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_8c8995b733ef_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "8c8995b733ef", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,196-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615166, "transport": "t", "ja3_hash": "a00a2beb3bcff07667f12b00083d38c7", "ja3_variant_count": 1, "ja3_variants": [ "a00a2beb3bcff07667f12b00083d38c7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_9757046a497d_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "9757046a497d", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49313-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615167, "transport": "t", "ja3_hash": "4b894279286bf5b41b3161dc42636a4a", "ja3_variant_count": 1, "ja3_variants": [ "4b894279286bf5b41b3161dc42636a4a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_a7802ed2ba9f_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "a7802ed2ba9f", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49310-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615166, "transport": "t", "ja3_hash": "41a392d845b2c693ab438b7e0c15b9cc", "ja3_variant_count": 1, "ja3_variants": [ "41a392d845b2c693ab438b7e0c15b9cc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_aaba3a77cce3_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "aaba3a77cce3", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49309-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615167, "transport": "t", "ja3_hash": "95fe83a19f2469a57aab48fc19c642a3", "ja3_variant_count": 1, "ja3_variants": [ "95fe83a19f2469a57aab48fc19c642a3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_c38774e7e0a0_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "c38774e7e0a0", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,22-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615169, "transport": "t", "ja3_hash": "6877dad7222e89abed8053346b4cd66b", "ja3_variant_count": 1, "ja3_variants": [ "6877dad7222e89abed8053346b4cd66b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_c94d2e240461_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "c94d2e240461", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,189-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615168, "transport": "t", "ja3_hash": "e657fea248dc7da78b812a5066f180c5", "ja3_variant_count": 1, "ja3_variants": [ "e657fea248dc7da78b812a5066f180c5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_dab6fbdff9f8_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "dab6fbdff9f8", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49314-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615169, "transport": "t", "ja3_hash": "91e46b8cf9bbfda5dfaf09bcd6881e8b", "ja3_variant_count": 1, "ja3_variants": [ "91e46b8cf9bbfda5dfaf09bcd6881e8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_efbfc930fd96_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "efbfc930fd96", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49315-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615165, "transport": "t", "ja3_hash": "43650aeef15076a3794caf47f963d130", "ja3_variant_count": 1, "ja3_variants": [ "43650aeef15076a3794caf47f963d130" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_f290bf0ab7b3_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "f290bf0ab7b3", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49311-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615170, "transport": "t", "ja3_hash": "a9f3223d1a7fe25b59d3bcbb50ac39b3", "ja3_variant_count": 1, "ja3_variants": [ "a9f3223d1a7fe25b59d3bcbb50ac39b3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_049d0968ef63_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "049d0968ef63", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49174-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615169, "transport": "t", "ja3_hash": "bc1d05488e0e311cb40a9cf17ffa0442", "ja3_variant_count": 1, "ja3_variants": [ "bc1d05488e0e311cb40a9cf17ffa0442" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_04f72be57293_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "04f72be57293", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49192-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615170, "transport": "t", "ja3_hash": "fc8edd01a759d91828b7fd7aee89e8c2", "ja3_variant_count": 1, "ja3_variants": [ "fc8edd01a759d91828b7fd7aee89e8c2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_0c0b01a5a80b_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "0c0b01a5a80b", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49193-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615167, "transport": "t", "ja3_hash": "c5dfe1ba06264ac2c19ecbfeb92420c9", "ja3_variant_count": 1, "ja3_variants": [ "c5dfe1ba06264ac2c19ecbfeb92420c9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_0d62a58dd912_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "0d62a58dd912", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49169-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615165, "transport": "t", "ja3_hash": "2a68e0edfb75449f012a41c40ab5a0f8", "ja3_variant_count": 1, "ja3_variants": [ "2a68e0edfb75449f012a41c40ab5a0f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_104943d1f64b_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "104943d1f64b", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49201-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615169, "transport": "t", "ja3_hash": "658111e6d488c28d0b0b571ba4a837fa", "ja3_variant_count": 1, "ja3_variants": [ "658111e6d488c28d0b0b571ba4a837fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_184f2be1a0c6_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "184f2be1a0c6", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49188-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615164, "transport": "t", "ja3_hash": "e5a8bc6555251d6c49ce7fc016bc8eb4", "ja3_variant_count": 1, "ja3_variants": [ "e5a8bc6555251d6c49ce7fc016bc8eb4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_24f557f1cbee_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "24f557f1cbee", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49191-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615165, "transport": "t", "ja3_hash": "b6b5e59e7cd6ddf7c6fece0dd8f24354", "ja3_variant_count": 1, "ja3_variants": [ "b6b5e59e7cd6ddf7c6fece0dd8f24354" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_2ac205266896_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "2ac205266896", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49173-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615171, "transport": "t", "ja3_hash": "280b33911384875094d7977f8382c88b", "ja3_variant_count": 1, "ja3_variants": [ "280b33911384875094d7977f8382c88b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_46916985df61_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "46916985df61", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49197-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615163, "transport": "t", "ja3_hash": "e7bad90c173a5eb0c656e487d20baa59", "ja3_variant_count": 1, "ja3_variants": [ "e7bad90c173a5eb0c656e487d20baa59" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_48762405b09c_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "48762405b09c", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49157-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615163, "transport": "t", "ja3_hash": "99bfe5bfcb1a6d096c438dcd5b250c32", "ja3_variant_count": 1, "ja3_variants": [ "99bfe5bfcb1a6d096c438dcd5b250c32" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_4eff32302ec7_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "4eff32302ec7", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49160-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615166, "transport": "t", "ja3_hash": "d061301761f8a73208570003415db861", "ja3_variant_count": 1, "ja3_variants": [ "d061301761f8a73208570003415db861" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_4f4bd29a6b59_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "4f4bd29a6b59", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49175-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615165, "transport": "t", "ja3_hash": "bc42f70d4193dbb72cf9d42887bd3fd5", "ja3_variant_count": 1, "ja3_variants": [ "bc42f70d4193dbb72cf9d42887bd3fd5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_53d483789bba_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "53d483789bba", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49198-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615167, "transport": "t", "ja3_hash": "9f4571c40c5de259206a3ebf63609ee2", "ja3_variant_count": 1, "ja3_variants": [ "9f4571c40c5de259206a3ebf63609ee2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_55a2bbf9cbd7_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "55a2bbf9cbd7", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49164-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615165, "transport": "t", "ja3_hash": "2e9854b292ced40a48b86ada2916d674", "ja3_variant_count": 1, "ja3_variants": [ "2e9854b292ced40a48b86ada2916d674" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_57ba72230e7a_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "57ba72230e7a", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49167-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825507, "last_seen": 1789615160, "transport": "t", "ja3_hash": "31c0236f152885b35de23a2ac087d39c", "ja3_variant_count": 1, "ja3_variants": [ "31c0236f152885b35de23a2ac087d39c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_59980b593f60_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "59980b593f60", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49176-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615164, "transport": "t", "ja3_hash": "a81b28d46213657f541046d58df5c5ec", "ja3_variant_count": 1, "ja3_variants": [ "a81b28d46213657f541046d58df5c5ec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_5b44afd80a2d_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "5b44afd80a2d", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49156-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615167, "transport": "t", "ja3_hash": "e3a1d08c5043ab4f583bb149b18c724b", "ja3_variant_count": 1, "ja3_variants": [ "e3a1d08c5043ab4f583bb149b18c724b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_5cd2152a341f_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "5cd2152a341f", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49194-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615162, "transport": "t", "ja3_hash": "4dcc5bffc8fe8bd59da602b0714ecddd", "ja3_variant_count": 1, "ja3_variants": [ "4dcc5bffc8fe8bd59da602b0714ecddd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_68cd44b4e773_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "68cd44b4e773", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49162-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615163, "transport": "t", "ja3_hash": "648c409cd9540d169e844c83cd06d549", "ja3_variant_count": 1, "ja3_variants": [ "648c409cd9540d169e844c83cd06d549" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_6a7d5ebe9983_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "6a7d5ebe9983", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49196-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615166, "transport": "t", "ja3_hash": "7003aedf501808019e07ba2938dff85e", "ja3_variant_count": 1, "ja3_variants": [ "7003aedf501808019e07ba2938dff85e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_6d4732649639_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "6d4732649639", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49195-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615168, "transport": "t", "ja3_hash": "abf5878120f4851ef3043565a618edd7", "ja3_variant_count": 1, "ja3_variants": [ "abf5878120f4851ef3043565a618edd7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_7368e9b57fb4_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "7368e9b57fb4", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49202-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615162, "transport": "t", "ja3_hash": "579a8e1fbc38ad41c9229fabb90fbe2f", "ja3_variant_count": 1, "ja3_variants": [ "579a8e1fbc38ad41c9229fabb90fbe2f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_89e01831f9a8_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "89e01831f9a8", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49153-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615165, "transport": "t", "ja3_hash": "7f8c883245e34484e5d8c134a3a2df94", "ja3_variant_count": 1, "ja3_variants": [ "7f8c883245e34484e5d8c134a3a2df94" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_8fc24edd70fe_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "8fc24edd70fe", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49163-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615169, "transport": "t", "ja3_hash": "527a4069ee07fd8a707bcee2392cf3cb", "ja3_variant_count": 1, "ja3_variants": [ "527a4069ee07fd8a707bcee2392cf3cb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_9b38dd297dfe_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "9b38dd297dfe", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49168-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615167, "transport": "t", "ja3_hash": "b5bfca2da44394d6f0398610821763a0", "ja3_variant_count": 1, "ja3_variants": [ "b5bfca2da44394d6f0398610821763a0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_a0546e0689fc_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "a0546e0689fc", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49171-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615164, "transport": "t", "ja3_hash": "64e502ecc82eb9bc8b59d3723e2b9a81", "ja3_variant_count": 1, "ja3_variants": [ "64e502ecc82eb9bc8b59d3723e2b9a81" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_a89416eb2da9_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "a89416eb2da9", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49177-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615172, "transport": "t", "ja3_hash": "74cdc182738d658059b5090b0b5ea03f", "ja3_variant_count": 1, "ja3_variants": [ "74cdc182738d658059b5090b0b5ea03f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_adebd50f2b51_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "adebd50f2b51", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49187-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615170, "transport": "t", "ja3_hash": "4be6dfd372a51d69dc2e2b86bbc35704", "ja3_variant_count": 1, "ja3_variants": [ "4be6dfd372a51d69dc2e2b86bbc35704" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_b06afd972a5c_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "b06afd972a5c", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49199-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615172, "transport": "t", "ja3_hash": "b7fa245d9cc1c34c7e4eb8876cf2d109", "ja3_variant_count": 1, "ja3_variants": [ "b7fa245d9cc1c34c7e4eb8876cf2d109" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_b2ba452b8222_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "b2ba452b8222", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49189-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615164, "transport": "t", "ja3_hash": "5824fddbf3cdbdc6d3d38cbce524181b", "ja3_variant_count": 1, "ja3_variants": [ "5824fddbf3cdbdc6d3d38cbce524181b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_bad2b1bd13d4_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "bad2b1bd13d4", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49155-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615171, "transport": "t", "ja3_hash": "e24abfecac94f4b14f0790a369c84b28", "ja3_variant_count": 1, "ja3_variants": [ "e24abfecac94f4b14f0790a369c84b28" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_c4610a930072_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "c4610a930072", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49159-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825511, "last_seen": 1789615165, "transport": "t", "ja3_hash": "629d38d0a40fb23ec8176402cec1d54d", "ja3_variant_count": 1, "ja3_variants": [ "629d38d0a40fb23ec8176402cec1d54d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_c66b7cee1896_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "c66b7cee1896", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49161-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615170, "transport": "t", "ja3_hash": "eca22c485bf110db00b4d6e9c94451a8", "ja3_variant_count": 1, "ja3_variants": [ "eca22c485bf110db00b4d6e9c94451a8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_cc27769a2ea2_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "cc27769a2ea2", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49165-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825519, "last_seen": 1789615170, "transport": "t", "ja3_hash": "4a7e04bcb48c30e0e56e955e0f1ab90c", "ja3_variant_count": 1, "ja3_variants": [ "4a7e04bcb48c30e0e56e955e0f1ab90c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_d0ac5cb1209a_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "d0ac5cb1209a", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49172-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615162, "transport": "t", "ja3_hash": "3aa22bcfc3bd391bba712d23d3ea3ffb", "ja3_variant_count": 1, "ja3_variants": [ "3aa22bcfc3bd391bba712d23d3ea3ffb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_d576ba9a1b51_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "d576ba9a1b51", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49154-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825509, "last_seen": 1789615164, "transport": "t", "ja3_hash": "373b1b207221cd58786dd4f223905523", "ja3_variant_count": 1, "ja3_variants": [ "373b1b207221cd58786dd4f223905523" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_efa2d734833b_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "efa2d734833b", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49158-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615166, "transport": "t", "ja3_hash": "b2a958e09a297ae5760c7daa1ee556ed", "ja3_variant_count": 1, "ja3_variants": [ "b2a958e09a297ae5760c7daa1ee556ed" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_f09d9ff7e6fc_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "f09d9ff7e6fc", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49200-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615173, "transport": "t", "ja3_hash": "2cc209247d593ad936b66e1ff41b8e13", "ja3_variant_count": 1, "ja3_variants": [ "2cc209247d593ad936b66e1ff41b8e13" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_f17337cd55b5_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "f17337cd55b5", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49166-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615165, "transport": "t", "ja3_hash": "ed5f71cbb4145c737a6bdc65da52c663", "ja3_variant_count": 1, "ja3_variants": [ "ed5f71cbb4145c737a6bdc65da52c663" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_f3042cbcf579_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "f3042cbcf579", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49170-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825512, "last_seen": 1789615166, "transport": "t", "ja3_hash": "daf9db206b0c68e3ba990c40b9e9d046", "ja3_variant_count": 1, "ja3_variants": [ "daf9db206b0c68e3ba990c40b9e9d046" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_f3e6ef936ef8_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "f3e6ef936ef8", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49190-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615171, "transport": "t", "ja3_hash": "3e1a06b6f5784e25c66f4fec6778c712", "ja3_variant_count": 1, "ja3_variants": [ "3e1a06b6f5784e25c66f4fec6778c712" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_0b689b8022c5_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "0b689b8022c5", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49326-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825518, "last_seen": 1789615167, "transport": "t", "ja3_hash": "97de585a249e5196ae21c9b21c88de6a", "ja3_variant_count": 1, "ja3_variants": [ "97de585a249e5196ae21c9b21c88de6a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_14e71d778212_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "14e71d778212", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,52393-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615166, "transport": "t", "ja3_hash": "6762d8c6c8f77c03634b4c1751c40c49", "ja3_variant_count": 1, "ja3_variants": [ "6762d8c6c8f77c03634b4c1751c40c49" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_1b38a54e016e_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "1b38a54e016e", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49248-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615166, "transport": "t", "ja3_hash": "04dc7a0bab909d568de9b015bdb1efc9", "ja3_variant_count": 1, "ja3_variants": [ "04dc7a0bab909d568de9b015bdb1efc9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_24d3b308d37f_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "24d3b308d37f", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49324-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615165, "transport": "t", "ja3_hash": "b001d24be2dd3dc341844a84424615fb", "ja3_variant_count": 1, "ja3_variants": [ "b001d24be2dd3dc341844a84424615fb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_294548954193_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "294548954193", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49325-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615168, "transport": "t", "ja3_hash": "60c081642c73ff130008cb049b8149dd", "ja3_variant_count": 1, "ja3_variants": [ "60c081642c73ff130008cb049b8149dd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_3933a476d3a7_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "3933a476d3a7", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49270-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825516, "last_seen": 1789615167, "transport": "t", "ja3_hash": "a28f1fe9b2df7106115aa4a98231098e", "ja3_variant_count": 1, "ja3_variants": [ "a28f1fe9b2df7106115aa4a98231098e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_423123446bcc_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "423123446bcc", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49327-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615162, "transport": "t", "ja3_hash": "f45ef16e4c8385df0c4d7f1292c9028f", "ja3_variant_count": 1, "ja3_variants": [ "f45ef16e4c8385df0c4d7f1292c9028f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_5c56dbb0f40e_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "5c56dbb0f40e", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49266-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615164, "transport": "t", "ja3_hash": "532b12915485e8e936eaff33e3200951", "ja3_variant_count": 1, "ja3_variants": [ "532b12915485e8e936eaff33e3200951" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_91989754f31d_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "91989754f31d", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49245-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825510, "last_seen": 1789615165, "transport": "t", "ja3_hash": "c8382e5b50e2ac631b52cd7c675a2124", "ja3_variant_count": 1, "ja3_variants": [ "c8382e5b50e2ac631b52cd7c675a2124" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_9c88c65f283c_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "9c88c65f283c", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49267-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825515, "last_seen": 1789615170, "transport": "t", "ja3_hash": "565f976384b2817bbf305bd05a1fd8f1", "ja3_variant_count": 1, "ja3_variants": [ "565f976384b2817bbf305bd05a1fd8f1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_a7d9af6b7eec_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "a7d9af6b7eec", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49271-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825514, "last_seen": 1789615165, "transport": "t", "ja3_hash": "97e3d54dd8ae88d3a2443bec11090e08", "ja3_variant_count": 1, "ja3_variants": [ "97e3d54dd8ae88d3a2443bec11090e08" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_c09a7b327a76_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "c09a7b327a76", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49244-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825520, "last_seen": 1789615168, "transport": "t", "ja3_hash": "caf6487fac473b52271460f9fd1c5db3", "ja3_variant_count": 1, "ja3_variants": [ "caf6487fac473b52271460f9fd1c5db3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_c5d8418a506e_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "c5d8418a506e", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,52392-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825517, "last_seen": 1789615168, "transport": "t", "ja3_hash": "4b183d3cace15e361ee45cd3800d4e4f", "ja3_variant_count": 1, "ja3_variants": [ "4b183d3cace15e361ee45cd3800d4e4f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_f705af3945da_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "f705af3945da", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49249-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825513, "last_seen": 1789615163, "transport": "t", "ja3_hash": "df3e1a630f19dc379b67c48589ed7f9b", "ja3_variant_count": 1, "ja3_variants": [ "df3e1a630f19dc379b67c48589ed7f9b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d030400_0f1f2c08f352_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d030400", "b": "0f1f2c08f352", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 3, "extension_count": 4, "alpn": null } }, "ja3_string": "771,156-157-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 12, "first_seen": 1787825505, "last_seen": 1789615159, "transport": "t", "ja3_hash": "0b776582cec922c90a7c5f38b21273f9", "ja3_variant_count": 1, "ja3_variants": [ "0b776582cec922c90a7c5f38b21273f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d061000_2be37fd24b6f_890e50abd467", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d061000", "b": "2be37fd24b6f", "c": "890e50abd467", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 6, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49196-49195-49199-49200-49171-49172,0-5-10-11-13-50-17-23-43-65281,29-23-24-25-30,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789536936, "last_seen": 1789536936, "transport": "t", "ja3_hash": "d5ddcc36f8ccea1430a723dd25625545", "ja3_variant_count": 1, "ja3_variants": [ "d5ddcc36f8ccea1430a723dd25625545" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d080800_723ebca51f63_0f3f62c4224e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d080800", "b": "723ebca51f63", "c": "0f3f62c4224e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 8, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-49199-49171-49172-156-47-53,10-11-13-23-0-17-5-65281,23-24-25-9-10-11-12-13-14-22,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789584327, "last_seen": 1789801309, "transport": "t", "ja3_hash": "fa78522a23d5fbac925a0fee11d910f5", "ja3_variant_count": 1, "ja3_variants": [ "fa78522a23d5fbac925a0fee11d910f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d080800_723ebca51f63_cc8988690cb2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d080800", "b": "723ebca51f63", "c": "cc8988690cb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 8, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-49199-49171-49172-156-47-53,0-10-11-13-50-23-43-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1789158805, "last_seen": 1789336262, "transport": "t", "ja3_hash": "b9b8af52a3f8069592aca97c9e835986", "ja3_variant_count": 1, "ja3_variants": [ "b9b8af52a3f8069592aca97c9e835986" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d100600_75366a718a82_e4ef29032766", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d100600", "b": "75366a718a82", "c": "e4ef29032766", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 10, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49172-53-49171-47-49196-49195-49200-157-49199-156,10-11-13-23-0-65281,23-24-25-9-10-11-12-13-14-22,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 18, "first_seen": 1788084398, "last_seen": 1788982905, "transport": "t", "ja3_hash": "0fc515c691d7ad55a8ff39986a921cdd", "ja3_variant_count": 1, "ja3_variants": [ "0fc515c691d7ad55a8ff39986a921cdd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1009h2_75366a718a82_65535e0805f6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1009h2", "b": "75366a718a82", "c": "65535e0805f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 10, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-49171-49172-156-157-47-53,10-65281-23-0-11-45-16-35-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789381775, "last_seen": 1789958019, "transport": "t", "ja3_hash": "52c5652817966baf1b17ae37c0a63207", "ja3_variant_count": 6, "ja3_variants": [ "52c5652817966baf1b17ae37c0a63207", "4c9b12f0ea8c2741365ed9b27112c14b", "0eedd1f803d2a8ea43ad726e6f02e136", "b8bfeee7ec2ac2205b1d65b76f262455", "e6435fec2ee4c39c6862b6f1b753843c", "b34e43a0a6ca2067637caa5b437af379" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1106h2_8256d93fd366_0f6eec4388ad", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1106h2", "b": "8256d93fd366", "c": "0f6eec4388ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 11, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,49196-49200-49195-49199-157-156-49172-49171-53-47-255,13-0-23-11-10-16,23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1789036522, "last_seen": 1789370355, "transport": "t", "ja3_hash": "a145c034e636923ac2fa80573b83e435", "ja3_variant_count": 1, "ja3_variants": [ "a145c034e636923ac2fa80573b83e435" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d120700_d34a8e72043a_5411ff8955b2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d120700", "b": "d34a8e72043a", "c": "5411ff8955b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 12, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49195-49196-52393-49199-49200-52392-49171-49172-156-157-47-53,0-23-65281-10-11-5-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788900558, "last_seen": 1788900742, "transport": "t", "ja3_hash": "6c0f0a346dcd84cb4b97a0d9382c53fd", "ja3_variant_count": 1, "ja3_variants": [ "6c0f0a346dcd84cb4b97a0d9382c53fd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1208h2_d34a8e72043a_19593551d184", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1208h2", "b": "d34a8e72043a", "c": "19593551d184", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 12, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,49195-49196-52393-49199-49200-52392-49171-49172-156-157-47-53,65281-0-23-35-13-16-11-10,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788981168, "last_seen": 1788981168, "transport": "t", "ja3_hash": "f6a0bfafe2bf7d9c79ffb3f269b64b46", "ja3_variant_count": 1, "ja3_variants": [ "f6a0bfafe2bf7d9c79ffb3f269b64b46" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1211h2_d34a8e72043a_3e116bb064ef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1211h2", "b": "d34a8e72043a", "c": "3e116bb064ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 12, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-18-13-28,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789316003, "last_seen": 1789316319, "transport": "t", "ja3_hash": "4e9725a4a78a23a30c381b0e4169508c", "ja3_variant_count": 1, "ja3_variants": [ "4e9725a4a78a23a30c381b0e4169508c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d130600_2d7513195f68_334f0aaed909", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d130600", "b": "2d7513195f68", "c": "334f0aaed909", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,0-5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 296, "first_seen": 1787459364, "last_seen": 1789966827, "transport": "t", "ja3_hash": "20c9baf81bfe96ff89722899e75d0190", "ja3_variant_count": 1, "ja3_variants": [ "20c9baf81bfe96ff89722899e75d0190" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d130800_2d7513195f68_984a83a01545", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d130800", "b": "2d7513195f68", "c": "984a83a01545", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,0-5-10-11-13-65281-15-18,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 38, "first_seen": 1787609619, "last_seen": 1789763702, "transport": "t", "ja3_hash": "bfa64571e2d6cadd2708d867ae17eab7", "ja3_variant_count": 1, "ja3_variants": [ "bfa64571e2d6cadd2708d867ae17eab7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_3ec6000827fa", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "3ec6000827fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730576, "last_seen": 1789730576, "transport": "t", "ja3_hash": "64fc1c5420e04d7c595e19f036aa2ac1", "ja3_variant_count": 1, "ja3_variants": [ "64fc1c5420e04d7c595e19f036aa2ac1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_429494ee3f11", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "429494ee3f11", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788457395, "last_seen": 1789701020, "transport": "t", "ja3_hash": "aef3af566cf8d969f0386e1d7c2e03a0", "ja3_variant_count": 1, "ja3_variants": [ "aef3af566cf8d969f0386e1d7c2e03a0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_ce8a6bf78de9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "ce8a6bf78de9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788496639, "last_seen": 1788496639, "transport": "t", "ja3_hash": "0074ba9fc16dde5c17ebd25771972fc6", "ja3_variant_count": 1, "ja3_variants": [ "0074ba9fc16dde5c17ebd25771972fc6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_497e282bcdb3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "497e282bcdb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788380819, "last_seen": 1788454100, "transport": "t", "ja3_hash": "32c3a4cbf210de5419fa47d999960100", "ja3_variant_count": 1, "ja3_variants": [ "32c3a4cbf210de5419fa47d999960100" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_a02b09871be3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "a02b09871be3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788390779, "last_seen": 1789591740, "transport": "t", "ja3_hash": "15f16b03fedd62e30eae2efe6780b90c", "ja3_variant_count": 1, "ja3_variants": [ "15f16b03fedd62e30eae2efe6780b90c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_bce43051f4df", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "bce43051f4df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-51-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788512725, "last_seen": 1788512725, "transport": "t", "ja3_hash": "75fd5531de3dbb956b250a752db9cf05", "ja3_variant_count": 1, "ja3_variants": [ "75fd5531de3dbb956b250a752db9cf05" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1504h2_8daaf6152771_5270fb343167", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1504h2", "b": "8daaf6152771", "c": "5270fb343167", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788777964, "last_seen": 1788777964, "transport": "t", "ja3_hash": "f4e736d63269075fb2a230f3520c0d82", "ja3_variant_count": 1, "ja3_variants": [ "f4e736d63269075fb2a230f3520c0d82" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_1a462c9789dd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "1a462c9789dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-35-51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789678500, "last_seen": 1789678500, "transport": "t", "ja3_hash": "1fb3cb5765e1cec89d9c215c44ed716e", "ja3_variant_count": 1, "ja3_variants": [ "1fb3cb5765e1cec89d9c215c44ed716e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_35b6f56c7eb3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "35b6f56c7eb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-45-35-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789830205, "last_seen": 1789830205, "transport": "t", "ja3_hash": "f67a3853c4edb192b23e9a51b8031ae0", "ja3_variant_count": 1, "ja3_variants": [ "f67a3853c4edb192b23e9a51b8031ae0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_7cba944e5a8c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "7cba944e5a8c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788457909, "last_seen": 1788457909, "transport": "t", "ja3_hash": "8d9f68c9c5c6068704b76dd35828fa10", "ja3_variant_count": 1, "ja3_variants": [ "8d9f68c9c5c6068704b76dd35828fa10" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_8c5587d0948a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "8c5587d0948a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-17613-0-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788931110, "last_seen": 1788931110, "transport": "t", "ja3_hash": "f8d0beadea30069dbd30a976a2f28801", "ja3_variant_count": 1, "ja3_variants": [ "f8d0beadea30069dbd30a976a2f28801" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_abd28e2180f6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "abd28e2180f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-13-0-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788901275, "last_seen": 1788901275, "transport": "t", "ja3_hash": "3e1742083f824236919d713777f6f245", "ja3_variant_count": 1, "ja3_variants": [ "3e1742083f824236919d713777f6f245" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_b6ed92a92e7e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "b6ed92a92e7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-18-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789545192, "last_seen": 1789545192, "transport": "t", "ja3_hash": "fdc41e5f66738ca2d0d4070988bfbe62", "ja3_variant_count": 1, "ja3_variants": [ "fdc41e5f66738ca2d0d4070988bfbe62" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_bbd76f0f44ff", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "bbd76f0f44ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-51-13-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789138905, "last_seen": 1789138905, "transport": "t", "ja3_hash": "e327ebd0def60ff8792a76a3bf2d1ebf", "ja3_variant_count": 1, "ja3_variants": [ "e327ebd0def60ff8792a76a3bf2d1ebf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_c9d0f7dfb209", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "c9d0f7dfb209", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-51764-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788777903, "last_seen": 1788777903, "transport": "t", "ja3_hash": "91c84b807bc1c0810e13067e8d2d76a1", "ja3_variant_count": 1, "ja3_variants": [ "91c84b807bc1c0810e13067e8d2d76a1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_d55415de9ed8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "d55415de9ed8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51764-65037-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788967491, "last_seen": 1788967491, "transport": "t", "ja3_hash": "7400ea1df7adfed2a8161097c145348a", "ja3_variant_count": 1, "ja3_variants": [ "7400ea1df7adfed2a8161097c145348a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_76495e6af5f8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "76495e6af5f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-10-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789673909, "last_seen": 1789673909, "transport": "t", "ja3_hash": "4f94fddbddae09c2ed25e8131a18d281", "ja3_variant_count": 1, "ja3_variants": [ "4f94fddbddae09c2ed25e8131a18d281" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_9c9d09fdf6fc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "9c9d09fdf6fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-16-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789273171, "last_seen": 1789273171, "transport": "t", "ja3_hash": "b99ddb44497e16724f99fa2b2f9ee5f2", "ja3_variant_count": 1, "ja3_variants": [ "b99ddb44497e16724f99fa2b2f9ee5f2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_13bd6874d7d9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "13bd6874d7d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-45-17613-27-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789820712, "last_seen": 1789820712, "transport": "t", "ja3_hash": "0783ae2d4ea266c58c2c306dd4a5f96f", "ja3_variant_count": 1, "ja3_variants": [ "0783ae2d4ea266c58c2c306dd4a5f96f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_37ee51ddf088", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "37ee51ddf088", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-11-0-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789796847, "last_seen": 1789796847, "transport": "t", "ja3_hash": "ad84bdb4f426196e53e46e8184fd1485", "ja3_variant_count": 1, "ja3_variants": [ "ad84bdb4f426196e53e46e8184fd1485" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_3d5f77db73c4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "3d5f77db73c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-11-65281-45-18,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789567936, "last_seen": 1789567936, "transport": "t", "ja3_hash": "71c9771f0fcd3311bd6b886849d94f8c", "ja3_variant_count": 1, "ja3_variants": [ "71c9771f0fcd3311bd6b886849d94f8c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_5c4623b73de1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "5c4623b73de1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-18-51-5-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789936905, "last_seen": 1789936905, "transport": "t", "ja3_hash": "fa60626b8f94e13622376f7f0b641a6a", "ja3_variant_count": 1, "ja3_variants": [ "fa60626b8f94e13622376f7f0b641a6a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_639f5b23ea83", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "639f5b23ea83", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-51-5-27-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788723901, "last_seen": 1788723901, "transport": "t", "ja3_hash": "3045169a71fd23fd3546936dfc942c33", "ja3_variant_count": 1, "ja3_variants": [ "3045169a71fd23fd3546936dfc942c33" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_63fa15bef6e0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "63fa15bef6e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-0-13-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788741901, "last_seen": 1788741901, "transport": "t", "ja3_hash": "dcb31ab7f26c8dfa527abf2e436035d1", "ja3_variant_count": 1, "ja3_variants": [ "dcb31ab7f26c8dfa527abf2e436035d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_ff74461ef9c0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "ff74461ef9c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-51-45-35-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788931417, "last_seen": 1788931417, "transport": "t", "ja3_hash": "86eed009831a65f50bba9cac61e7a493", "ja3_variant_count": 1, "ja3_variants": [ "86eed009831a65f50bba9cac61e7a493" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_0cce2b9ea82c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "0cce2b9ea82c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-0-45-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788881853, "last_seen": 1788881853, "transport": "t", "ja3_hash": "b531bee516626bb244c5f3b79ae8e418", "ja3_variant_count": 1, "ja3_variants": [ "b531bee516626bb244c5f3b79ae8e418" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_176020b02836", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "176020b02836", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-0-16-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788950145, "last_seen": 1788950145, "transport": "t", "ja3_hash": "6c86ed27a3709e978fb704fd306f44d3", "ja3_variant_count": 1, "ja3_variants": [ "6c86ed27a3709e978fb704fd306f44d3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_3e3412553152", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "3e3412553152", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-18-16-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015034, "last_seen": 1789015034, "transport": "t", "ja3_hash": "8f360f4033bf7bb5f3496a7dfdd940a8", "ja3_variant_count": 1, "ja3_variants": [ "8f360f4033bf7bb5f3496a7dfdd940a8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_673f55a6b7cc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "673f55a6b7cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-23-16-45-35,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789931638, "last_seen": 1789931638, "transport": "t", "ja3_hash": "1dafbc83ae5634a68a4d6a7fb7f58692", "ja3_variant_count": 1, "ja3_variants": [ "1dafbc83ae5634a68a4d6a7fb7f58692" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_a9172a2673a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "a9172a2673a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-45-13-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391195, "last_seen": 1789391195, "transport": "t", "ja3_hash": "cd3a698a6ad229edd3abe5dde4776ede", "ja3_variant_count": 1, "ja3_variants": [ "cd3a698a6ad229edd3abe5dde4776ede" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_db24bf97f5a0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "db24bf97f5a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-65281-17613-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788522735, "last_seen": 1788522735, "transport": "t", "ja3_hash": "b70a0a9308565dc14418eef36a3b000a", "ja3_variant_count": 1, "ja3_variants": [ "b70a0a9308565dc14418eef36a3b000a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_fd822ef56a30", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "fd822ef56a30", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-0-27-16-35,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788840250, "last_seen": 1788840250, "transport": "t", "ja3_hash": "4be498a28b7ff7994338b8d3572c05eb", "ja3_variant_count": 1, "ja3_variants": [ "4be498a28b7ff7994338b8d3572c05eb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_0057df142f55", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "0057df142f55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-35-0-27-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839551, "last_seen": 1788839551, "transport": "t", "ja3_hash": "0d3945c7cb1f5e29e7a3989d02622c4b", "ja3_variant_count": 1, "ja3_variants": [ "0d3945c7cb1f5e29e7a3989d02622c4b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_4e31eef87a7f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "4e31eef87a7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-65281-13-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789024345, "last_seen": 1789024345, "transport": "t", "ja3_hash": "eca48267e726c70f75357905345bd9f2", "ja3_variant_count": 1, "ja3_variants": [ "eca48267e726c70f75357905345bd9f2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_54eba23e8458", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "54eba23e8458", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-5-10-0-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789689010, "last_seen": 1789689010, "transport": "t", "ja3_hash": "5cbbd3b17190cca0028cc42c64dc896c", "ja3_variant_count": 1, "ja3_variants": [ "5cbbd3b17190cca0028cc42c64dc896c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_79f13ed3d2a1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "79f13ed3d2a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-45-27-18-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788508347, "last_seen": 1788508347, "transport": "t", "ja3_hash": "3998f22553163699fc8519a52c4eaed5", "ja3_variant_count": 1, "ja3_variants": [ "3998f22553163699fc8519a52c4eaed5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d095039daad6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d095039daad6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-65037-0-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788931107, "last_seen": 1788931107, "transport": "t", "ja3_hash": "b8e75be57706451a30dae8429b5f5b28", "ja3_variant_count": 1, "ja3_variants": [ "b8e75be57706451a30dae8429b5f5b28" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d83a331042bd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d83a331042bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-17613-51-18-0-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015037, "last_seen": 1789015037, "transport": "t", "ja3_hash": "7e436368f76c54f342d5afa68dbf5802", "ja3_variant_count": 1, "ja3_variants": [ "7e436368f76c54f342d5afa68dbf5802" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d863a184b2bf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d863a184b2bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-0-51-45-17613-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789430574, "last_seen": 1789430574, "transport": "t", "ja3_hash": "11de1f8787e89df704b0dc0b7f738b21", "ja3_variant_count": 1, "ja3_variants": [ "11de1f8787e89df704b0dc0b7f738b21" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_fae9a2cfd2c2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "fae9a2cfd2c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-0-13-10-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788455082, "last_seen": 1788455082, "transport": "t", "ja3_hash": "971fb9c1e45c1739f7eb13bb12c203e6", "ja3_variant_count": 1, "ja3_variants": [ "971fb9c1e45c1739f7eb13bb12c203e6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_19749150f3ea", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "19749150f3ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-16-45-51-18-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789782405, "last_seen": 1789782405, "transport": "t", "ja3_hash": "b832809ae2118ee10773c97f5d2a592a", "ja3_variant_count": 1, "ja3_variants": [ "b832809ae2118ee10773c97f5d2a592a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_f795958b1e9e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "f795958b1e9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-65281-0-35-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789523581, "last_seen": 1789523581, "transport": "t", "ja3_hash": "dc35f56547f0d062dadfeff0e6da39f8", "ja3_variant_count": 1, "ja3_variants": [ "dc35f56547f0d062dadfeff0e6da39f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_5191e0f59afb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "5191e0f59afb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-13-5-18-0-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788454695, "last_seen": 1788454695, "transport": "t", "ja3_hash": "892c1dbe9f29bb01fcaa0c8acdb80d8f", "ja3_variant_count": 1, "ja3_variants": [ "892c1dbe9f29bb01fcaa0c8acdb80d8f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_627085196049", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "627085196049", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-0-11-45-35-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788514982, "last_seen": 1788514982, "transport": "t", "ja3_hash": "5f41765b02173eff709f54545da8d186", "ja3_variant_count": 1, "ja3_variants": [ "5f41765b02173eff709f54545da8d186" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_6bc0c5f98f17", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "6bc0c5f98f17", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-5-0-51-35-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789710064, "last_seen": 1789710064, "transport": "t", "ja3_hash": "51e1059582852677c6c13fad537a1b5e", "ja3_variant_count": 1, "ja3_variants": [ "51e1059582852677c6c13fad537a1b5e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_6f5b6dbeb8b7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "6f5b6dbeb8b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-51764-35-5-23-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789403158, "last_seen": 1789403158, "transport": "t", "ja3_hash": "fee824a631185cadafbe3adb71a6cf96", "ja3_variant_count": 1, "ja3_variants": [ "fee824a631185cadafbe3adb71a6cf96" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_8bc775336eba", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "8bc775336eba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-45-0-17613-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789235875, "last_seen": 1789235875, "transport": "t", "ja3_hash": "66001bd59a0d5b8e96923e2e298b2086", "ja3_variant_count": 1, "ja3_variants": [ "66001bd59a0d5b8e96923e2e298b2086" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_9a51be28706b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "9a51be28706b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-35-51-18-23-65281-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789441227, "last_seen": 1789441227, "transport": "t", "ja3_hash": "ab07f41cb35980a55446ada04e463602", "ja3_variant_count": 1, "ja3_variants": [ "ab07f41cb35980a55446ada04e463602" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a44cb64a16a7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a44cb64a16a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-5-45-65037-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789414881, "last_seen": 1789414881, "transport": "t", "ja3_hash": "b3c12071292e3643e090735ff1299937", "ja3_variant_count": 1, "ja3_variants": [ "b3c12071292e3643e090735ff1299937" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a639675138d0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a639675138d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-5-23-11-65037-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789889717, "last_seen": 1789889717, "transport": "t", "ja3_hash": "41b5426e9d6fa354e354fa4b06d1f721", "ja3_variant_count": 1, "ja3_variants": [ "41b5426e9d6fa354e354fa4b06d1f721" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a74d40297a66", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a74d40297a66", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-17613-45-0-5-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789476164, "last_seen": 1789476164, "transport": "t", "ja3_hash": "12e5ff67f919dfaa62f89ed137b1926f", "ja3_variant_count": 1, "ja3_variants": [ "12e5ff67f919dfaa62f89ed137b1926f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_add12feb5136", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "add12feb5136", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-0-51-5-23-17613-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788824579, "last_seen": 1788824579, "transport": "t", "ja3_hash": "aaa45fe8ff3fd78eee3a43f66a947319", "ja3_variant_count": 1, "ja3_variants": [ "aaa45fe8ff3fd78eee3a43f66a947319" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_d371e35c1464", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "d371e35c1464", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-10-45-18-17613-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788876071, "last_seen": 1788876071, "transport": "t", "ja3_hash": "d4a3497d8124ad6405e167e963f36f66", "ja3_variant_count": 1, "ja3_variants": [ "d4a3497d8124ad6405e167e963f36f66" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_f0372e1b54d3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "f0372e1b54d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-11-0-51-17613-27-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789438953, "last_seen": 1789438953, "transport": "t", "ja3_hash": "d1a7c0890dd59831ffcac9356e172bc0", "ja3_variant_count": 1, "ja3_variants": [ "d1a7c0890dd59831ffcac9356e172bc0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_f77c81d758e4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "f77c81d758e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-18-35-5-65037-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788865987, "last_seen": 1788865987, "transport": "t", "ja3_hash": "4267c09904b940b36ed563fa9b9378af", "ja3_variant_count": 1, "ja3_variants": [ "4267c09904b940b36ed563fa9b9378af" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_faa7bb6c7b82", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "faa7bb6c7b82", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-45-17613-27-11-4832-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788640782, "last_seen": 1788640782, "transport": "t", "ja3_hash": "d66a0c0f0a19095c9c1720f83fec7e09", "ja3_variant_count": 1, "ja3_variants": [ "d66a0c0f0a19095c9c1720f83fec7e09" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_3bfade727e0f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "3bfade727e0f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-16-65281-51764-45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789653256, "last_seen": 1789653256, "transport": "t", "ja3_hash": "064f87b9ab601f05e1472b45d0684350", "ja3_variant_count": 1, "ja3_variants": [ "064f87b9ab601f05e1472b45d0684350" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_813dfe679edd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "813dfe679edd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-65037-16-5-65281-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789552176, "last_seen": 1789552176, "transport": "t", "ja3_hash": "dc902b3e2ea9779459e4aaa1f4982194", "ja3_variant_count": 1, "ja3_variants": [ "dc902b3e2ea9779459e4aaa1f4982194" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_9369beeae83e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "9369beeae83e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-51-0-65281-27-5-45,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788738605, "last_seen": 1788738605, "transport": "t", "ja3_hash": "a0ad6a085e1f179ceed039ed418eca0d", "ja3_variant_count": 1, "ja3_variants": [ "a0ad6a085e1f179ceed039ed418eca0d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_a6b0c87175ef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "a6b0c87175ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-45-11-5-16-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469871, "last_seen": 1789469871, "transport": "t", "ja3_hash": "3396752e844fde3f7552be0a450836ad", "ja3_variant_count": 1, "ja3_variants": [ "3396752e844fde3f7552be0a450836ad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_b6f8ec3d8e37", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "b6f8ec3d8e37", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-65281-51-27-16-23-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789292874, "last_seen": 1789292874, "transport": "t", "ja3_hash": "5b19ae05f7e24f24ca84931a90a65787", "ja3_variant_count": 1, "ja3_variants": [ "5b19ae05f7e24f24ca84931a90a65787" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_e6da9eb9f4c6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "e6da9eb9f4c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-35-16-65281-0-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789077103, "last_seen": 1789077103, "transport": "t", "ja3_hash": "605e7e10b0f67428eb73d25fe4f72028", "ja3_variant_count": 1, "ja3_variants": [ "605e7e10b0f67428eb73d25fe4f72028" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_f6db8740d7a0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "f6db8740d7a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-18-13-35-65037-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789741135, "last_seen": 1789741135, "transport": "t", "ja3_hash": "024d1d193e9bf56b0d19a312307b82aa", "ja3_variant_count": 1, "ja3_variants": [ "024d1d193e9bf56b0d19a312307b82aa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508ht_8daaf6152771_d46b1a7a0cd8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508ht", "b": "8daaf6152771", "c": "d46b1a7a0cd8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-35-16-45-23-0-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788833599, "last_seen": 1788833599, "transport": "t", "ja3_hash": "53c2adc84fc844e238dc82db5088c185", "ja3_variant_count": 1, "ja3_variants": [ "53c2adc84fc844e238dc82db5088c185" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508ht_d68b136fe8d9_b48d617224fb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508ht", "b": "d68b136fe8d9", "c": "b48d617224fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,0-11-10-35-16-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787796837, "last_seen": 1789008931, "transport": "t", "ja3_hash": "104774240db569f8f87b1a28206b25e5", "ja3_variant_count": 1, "ja3_variants": [ "104774240db569f8f87b1a28206b25e5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_46715ce85483", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "46715ce85483", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-65281-45-18-23-0-27-11,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024342, "last_seen": 1789024342, "transport": "t", "ja3_hash": "ce6cb52e1e0d018864a11137941ffcb0", "ja3_variant_count": 1, "ja3_variants": [ "ce6cb52e1e0d018864a11137941ffcb0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_4bb688850a24", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "4bb688850a24", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-65037-17613-5-0-13-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789034184, "last_seen": 1789034184, "transport": "t", "ja3_hash": "f74ac75d936ca8898996418479260f0f", "ja3_variant_count": 1, "ja3_variants": [ "f74ac75d936ca8898996418479260f0f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_5af7402554af", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "5af7402554af", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51764-35-45-0-65281-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788850318, "last_seen": 1788850318, "transport": "t", "ja3_hash": "a68ec588cb899e10e4c09b5981d1600a", "ja3_variant_count": 1, "ja3_variants": [ "a68ec588cb899e10e4c09b5981d1600a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_5bc67ae21ca9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "5bc67ae21ca9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-18-13-27-45-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789273178, "last_seen": 1789273178, "transport": "t", "ja3_hash": "3934f103898c9a7e978e7b279fdb4e83", "ja3_variant_count": 1, "ja3_variants": [ "3934f103898c9a7e978e7b279fdb4e83" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_af5f7beb6812", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "af5f7beb6812", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-23-27-65037-11-0-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789906993, "last_seen": 1789906993, "transport": "t", "ja3_hash": "d414672c2fafa2d53df4ea920e580f5f", "ja3_variant_count": 1, "ja3_variants": [ "d414672c2fafa2d53df4ea920e580f5f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_c40e424fa782", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "c40e424fa782", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-35-0-65037-5-45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789920883, "last_seen": 1789920883, "transport": "t", "ja3_hash": "2405f6e0ef93f2d625c17f48b210d7cd", "ja3_variant_count": 1, "ja3_variants": [ "2405f6e0ef93f2d625c17f48b210d7cd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_f5b0dccee7a7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "f5b0dccee7a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-0-45-11-51-23-65281-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789820714, "last_seen": 1789820714, "transport": "t", "ja3_hash": "b5c0e4c50b9d8267fdc58f9eaa5460a9", "ja3_variant_count": 1, "ja3_variants": [ "b5c0e4c50b9d8267fdc58f9eaa5460a9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_34da5227fddb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "34da5227fddb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-17613-13-23-27-11-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789015038, "last_seen": 1789015038, "transport": "t", "ja3_hash": "bfdc7c0633e5f55b9fb9319c3c4b90f3", "ja3_variant_count": 1, "ja3_variants": [ "bfdc7c0633e5f55b9fb9319c3c4b90f3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_44d1185a2354", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "44d1185a2354", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-10-17613-65281-16-11-18-51,514-4588-24-23-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789201602, "last_seen": 1789201602, "transport": "t", "ja3_hash": "56e39da25b4947c67462865651f33cbf", "ja3_variant_count": 1, "ja3_variants": [ "56e39da25b4947c67462865651f33cbf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_4eb309d87007", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "4eb309d87007", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-0-16-5-65281-17613-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789192495, "last_seen": 1789192495, "transport": "t", "ja3_hash": "247fc9dbd28942d99778ba5c5d23ec0a", "ja3_variant_count": 1, "ja3_variants": [ "247fc9dbd28942d99778ba5c5d23ec0a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_d26ae7312481", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "d26ae7312481", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-10-65037-5-16-18-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788964092, "last_seen": 1788964092, "transport": "t", "ja3_hash": "e201494983a440145265db3367223372", "ja3_variant_count": 1, "ja3_variants": [ "e201494983a440145265db3367223372" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_df935ef199fb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "df935ef199fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-10-16-0-23-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788900227, "last_seen": 1788900227, "transport": "t", "ja3_hash": "8d9a94adb54fed83d507bd09680f3f14", "ja3_variant_count": 1, "ja3_variants": [ "8d9a94adb54fed83d507bd09680f3f14" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e3e9b8d060d3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e3e9b8d060d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,45-17613-0-13-5-16-11-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789472898, "last_seen": 1789472898, "transport": "t", "ja3_hash": "9c20f7dbce8b71fa7a9c291cf2ec63e7", "ja3_variant_count": 1, "ja3_variants": [ "9c20f7dbce8b71fa7a9c291cf2ec63e7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e3fad44bbfad", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e3fad44bbfad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-0-16-65281-27-13-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789883821, "last_seen": 1789883821, "transport": "t", "ja3_hash": "37d6f53b78bf01bb2666d473b1168dc7", "ja3_variant_count": 1, "ja3_variants": [ "37d6f53b78bf01bb2666d473b1168dc7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_f3dc2e5a963f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "f3dc2e5a963f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,0-65281-51764-23-13-35-16-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789842146, "last_seen": 1789842146, "transport": "t", "ja3_hash": "1d53df4fcce4971702807c9f178ca1c4", "ja3_variant_count": 1, "ja3_variants": [ "1d53df4fcce4971702807c9f178ca1c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509ht_8daaf6152771_e612fdce8799", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509ht", "b": "8daaf6152771", "c": "e612fdce8799", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-35-23-13-5-65281-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789632712, "last_seen": 1789632712, "transport": "t", "ja3_hash": "d72fcd3c8cb80db38a035b5832f59618", "ja3_variant_count": 1, "ja3_variants": [ "d72fcd3c8cb80db38a035b5832f59618" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_2f990aa6ee5c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "2f990aa6ee5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-45-27-10-51-65281-11-18-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789617348, "last_seen": 1789617348, "transport": "t", "ja3_hash": "94c1d3721512febfeef47d1226f7a955", "ja3_variant_count": 1, "ja3_variants": [ "94c1d3721512febfeef47d1226f7a955" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_523d701eca2b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "523d701eca2b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-18-65281-11-10-23-0-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788827725, "last_seen": 1788827725, "transport": "t", "ja3_hash": "54ee17a12090f793f90ce9f1135234b5", "ja3_variant_count": 1, "ja3_variants": [ "54ee17a12090f793f90ce9f1135234b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_5df31951296b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "5df31951296b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-13-17613-0-10-11-5-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789795319, "last_seen": 1789795319, "transport": "t", "ja3_hash": "4d0982f10c004fa9568d99401309122d", "ja3_variant_count": 1, "ja3_variants": [ "4d0982f10c004fa9568d99401309122d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_62df07232a7a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "62df07232a7a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-27-23-11-17613-45-65281-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789516357, "last_seen": 1789516357, "transport": "t", "ja3_hash": "5d21f8a9e6f9e6db675903c9d7853fc2", "ja3_variant_count": 1, "ja3_variants": [ "5d21f8a9e6f9e6db675903c9d7853fc2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_9db121d5a102", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "9db121d5a102", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-11-10-27-35-0-23-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788849256, "last_seen": 1788849256, "transport": "t", "ja3_hash": "3750baf84980733fd552e37d5d70b5fd", "ja3_variant_count": 1, "ja3_variants": [ "3750baf84980733fd552e37d5d70b5fd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_a85ddeecf8d7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "a85ddeecf8d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-11-0-18-45-5-35-51-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788823315, "last_seen": 1788823315, "transport": "t", "ja3_hash": "8b80eaa32de7e09382699508c20e7d03", "ja3_variant_count": 1, "ja3_variants": [ "8b80eaa32de7e09382699508c20e7d03" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_aac991d9ed80", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "aac991d9ed80", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-0-65037-35-23-13-5-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788471863, "last_seen": 1788471863, "transport": "t", "ja3_hash": "973943f3f3fdced0cf2789f858914948", "ja3_variant_count": 1, "ja3_variants": [ "973943f3f3fdced0cf2789f858914948" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_b9baecb34289", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "b9baecb34289", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-10-51-23-11-18-5-0-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789734399, "last_seen": 1789734399, "transport": "t", "ja3_hash": "80919e75bfef013424564f8f2f15171c", "ja3_variant_count": 1, "ja3_variants": [ "80919e75bfef013424564f8f2f15171c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_d8a888bb3d8d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "d8a888bb3d8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-0-35-13-51764-11-65037-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788459237, "last_seen": 1788459237, "transport": "t", "ja3_hash": "e740d5d2978bcedccce424a2de18e8e5", "ja3_variant_count": 1, "ja3_variants": [ "e740d5d2978bcedccce424a2de18e8e5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_073e58a039a6_f412d49686a8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "073e58a039a6", "c": "f412d49686a8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-51-57-47-53-10,0-23-65281-10-11-35-16-5-13-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789720976, "last_seen": 1789720976, "transport": "t", "ja3_hash": "2efb07037a97b06201ab4fe7ec0c326e", "ja3_variant_count": 1, "ja3_variants": [ "2efb07037a97b06201ab4fe7ec0c326e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_1418c4ebac11", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "1418c4ebac11", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-0-13-27-51764-16-45-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788988737, "last_seen": 1788988737, "transport": "t", "ja3_hash": "01b0ea21130ebe41e72b61c2f45ca63c", "ja3_variant_count": 1, "ja3_variants": [ "01b0ea21130ebe41e72b61c2f45ca63c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_22cd2ddff142", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "22cd2ddff142", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-27-5-10-0-17613-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788533129, "last_seen": 1788533129, "transport": "t", "ja3_hash": "89b125f17b6f98570e2866e44e4488d7", "ja3_variant_count": 1, "ja3_variants": [ "89b125f17b6f98570e2866e44e4488d7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_31b3f0ca4214", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "31b3f0ca4214", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51764-0-16-45-13-17613-18-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469868, "last_seen": 1789469868, "transport": "t", "ja3_hash": "65bd35b429eb05d38a9383c4640cd2d0", "ja3_variant_count": 1, "ja3_variants": [ "65bd35b429eb05d38a9383c4640cd2d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_5fad27cca7f5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "5fad27cca7f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-0-27-65037-35-13-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788552183, "last_seen": 1788552183, "transport": "t", "ja3_hash": "7cd157e9c264b2662ac20b869c6fb302", "ja3_variant_count": 1, "ja3_variants": [ "7cd157e9c264b2662ac20b869c6fb302" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_61ca40b4f65c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "61ca40b4f65c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-5-45-65281-0-10-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789488142, "last_seen": 1789488142, "transport": "t", "ja3_hash": "046d7bd190ce7b0004b3591efed3f134", "ja3_variant_count": 1, "ja3_variants": [ "046d7bd190ce7b0004b3591efed3f134" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_6916f2462b08", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "6916f2462b08", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-16-18-45-65281-35-0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391195, "last_seen": 1789391195, "transport": "t", "ja3_hash": "5debb2e64b58fabeced19e47916d33e5", "ja3_variant_count": 1, "ja3_variants": [ "5debb2e64b58fabeced19e47916d33e5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_7210f722cecb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "7210f722cecb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-16-10-35-45-51764-23-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788866164, "last_seen": 1788866164, "transport": "t", "ja3_hash": "a3bc6c4fe9362831c56632ffdb7931b9", "ja3_variant_count": 1, "ja3_variants": [ "a3bc6c4fe9362831c56632ffdb7931b9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_a41c225e7e00", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "a41c225e7e00", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-51764-0-65037-27-10-16-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669044, "last_seen": 1789669044, "transport": "t", "ja3_hash": "3a74b286654514a3133f4b59f83091a7", "ja3_variant_count": 1, "ja3_variants": [ "3a74b286654514a3133f4b59f83091a7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_c208f6e9ed61", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "c208f6e9ed61", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-13-65281-11-0-65037-16-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788835567, "last_seen": 1788835567, "transport": "t", "ja3_hash": "bbb41189b46a0fa416ecec80da569698", "ja3_variant_count": 1, "ja3_variants": [ "bbb41189b46a0fa416ecec80da569698" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_d50223eb16d4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "d50223eb16d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-45-65281-16-23-65037-35-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789480245, "last_seen": 1789480245, "transport": "t", "ja3_hash": "a3d701ad1ae18fceff2e385187a2fa58", "ja3_variant_count": 1, "ja3_variants": [ "a3d701ad1ae18fceff2e385187a2fa58" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_d5afbd9b6dc6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "d5afbd9b6dc6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-65037-17613-0-16-45-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789034271, "last_seen": 1789034271, "transport": "t", "ja3_hash": "81df38f31899ff2c647be5eaf98ffad2", "ja3_variant_count": 1, "ja3_variants": [ "81df38f31899ff2c647be5eaf98ffad2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_e9a9a2d509ea", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "e9a9a2d509ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-23-45-16-10-17613-0-5-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789731601, "last_seen": 1789731601, "transport": "t", "ja3_hash": "0e6bffb02fec07d603a4270cdf474175", "ja3_variant_count": 1, "ja3_variants": [ "0e6bffb02fec07d603a4270cdf474175" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_376a4abb92cd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "376a4abb92cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-17613-13-65281-35-27-23-5-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788867825, "last_seen": 1788867825, "transport": "t", "ja3_hash": "7a88995207618e1040463c8b71797cf2", "ja3_variant_count": 1, "ja3_variants": [ "7a88995207618e1040463c8b71797cf2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_46d437b2278e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "46d437b2278e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-0-18-5-65037-65281-10-35-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789269660, "last_seen": 1789269660, "transport": "t", "ja3_hash": "26903a56860f40e278a1779fcf386a5b", "ja3_variant_count": 1, "ja3_variants": [ "26903a56860f40e278a1779fcf386a5b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_5a9f01285ae2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "5a9f01285ae2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-51764-23-13-5-45-27-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789923910, "last_seen": 1789923910, "transport": "t", "ja3_hash": "6014aa0e32229beb3c551ade43fa8960", "ja3_variant_count": 1, "ja3_variants": [ "6014aa0e32229beb3c551ade43fa8960" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_6254c299e43d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "6254c299e43d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-35-65037-10-5-45-18-27-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789733001, "last_seen": 1789733001, "transport": "t", "ja3_hash": "cda07e5fe8447bac691e299d29c10a2c", "ja3_variant_count": 1, "ja3_variants": [ "cda07e5fe8447bac691e299d29c10a2c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_cc03343b474a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "cc03343b474a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-5-10-65037-11-23-18-0-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789965149, "last_seen": 1789965149, "transport": "t", "ja3_hash": "7a98523a1a6fcf24446dfd28bd3a6faa", "ja3_variant_count": 1, "ja3_variants": [ "7a98523a1a6fcf24446dfd28bd3a6faa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_11d1cbdbfd55", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "11d1cbdbfd55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-65281-18-45-5-11-35-0-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788711051, "last_seen": 1788711051, "transport": "t", "ja3_hash": "65575514a1679863c74df4f2d8202588", "ja3_variant_count": 1, "ja3_variants": [ "65575514a1679863c74df4f2d8202588" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_12b57c03608b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "12b57c03608b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-16-5-23-65281-11-51764-18-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788711048, "last_seen": 1788711048, "transport": "t", "ja3_hash": "454160b82bdf025d8170b10e9fa46c41", "ja3_variant_count": 1, "ja3_variants": [ "454160b82bdf025d8170b10e9fa46c41" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_30f1155c97f6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "30f1155c97f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-27-16-10-23-0-11-65037-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788899788, "last_seen": 1788899788, "transport": "t", "ja3_hash": "5ed7e2868ace9f6b22dde3ece898fb64", "ja3_variant_count": 1, "ja3_variants": [ "5ed7e2868ace9f6b22dde3ece898fb64" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_6fa7b7c5ab3c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "6fa7b7c5ab3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-0-18-65281-65037-13-5-16-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789750663, "last_seen": 1789750663, "transport": "t", "ja3_hash": "5286ce1b825385b24877b718aee72c6d", "ja3_variant_count": 1, "ja3_variants": [ "5286ce1b825385b24877b718aee72c6d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_722609c4e077", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "722609c4e077", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-18-11-27-5-16-23-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788515687, "last_seen": 1788515687, "transport": "t", "ja3_hash": "f1f96f94a8875bf2cfa7379701e03255", "ja3_variant_count": 1, "ja3_variants": [ "f1f96f94a8875bf2cfa7379701e03255" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_7d660fe68177", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "7d660fe68177", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-13-65037-0-18-17513-16-65281-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788976469, "last_seen": 1788976469, "transport": "t", "ja3_hash": "ffcc08672b6d994fbcf081f88cb8da0f", "ja3_variant_count": 1, "ja3_variants": [ "ffcc08672b6d994fbcf081f88cb8da0f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_c072d18c18cf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "c072d18c18cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-51764-16-23-13-5-0-17613-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789667827, "last_seen": 1789667827, "transport": "t", "ja3_hash": "4b102c4fc8b89c05b6426d177cdc444f", "ja3_variant_count": 1, "ja3_variants": [ "4b102c4fc8b89c05b6426d177cdc444f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_e136dacb97e7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "e136dacb97e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-10-45-65281-17613-18-11-16-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788900222, "last_seen": 1788900222, "transport": "t", "ja3_hash": "de4b6e38c29a858c7d13a01206dac93f", "ja3_variant_count": 1, "ja3_variants": [ "de4b6e38c29a858c7d13a01206dac93f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_f0cac484eba8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "f0cac484eba8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-51764-65281-10-18-16-45-35-0-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789753861, "last_seen": 1789753861, "transport": "t", "ja3_hash": "6805836f5f99a9b03fb4020c1338fcb9", "ja3_variant_count": 1, "ja3_variants": [ "6805836f5f99a9b03fb4020c1338fcb9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_1688fab856b5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "1688fab856b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-13-23-27-18-65281-11-10-45-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788900226, "last_seen": 1788900226, "transport": "t", "ja3_hash": "0b4e24905d6247e6a187a6ff092cce33", "ja3_variant_count": 1, "ja3_variants": [ "0b4e24905d6247e6a187a6ff092cce33" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_c1d43cf48b3a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "c1d43cf48b3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-51764-27-11-35-0-65281-45-23-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789617879, "last_seen": 1789617879, "transport": "t", "ja3_hash": "98e2f935a084628a04b84e2928137d40", "ja3_variant_count": 1, "ja3_variants": [ "98e2f935a084628a04b84e2928137d40" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_c8def42c56a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "c8def42c56a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-13-35-51764-65281-10-65037-45-17613-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469868, "last_seen": 1789469868, "transport": "t", "ja3_hash": "7205c217a6cbdd4a5d219909969f5e4f", "ja3_variant_count": 1, "ja3_variants": [ "7205c217a6cbdd4a5d219909969f5e4f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_1235052c0395", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "1235052c0395", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-16-13-35-65037-45-18-27-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789024339, "last_seen": 1789024339, "transport": "t", "ja3_hash": "773f5d065ef239d720fc6a3863675107", "ja3_variant_count": 1, "ja3_variants": [ "773f5d065ef239d720fc6a3863675107" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_2170f86d61b1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "2170f86d61b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-17613-0-35-45-51764-27-65281-16-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789063166, "last_seen": 1789063166, "transport": "t", "ja3_hash": "ad504cacf16817c0b679c2e20dc16e1f", "ja3_variant_count": 1, "ja3_variants": [ "ad504cacf16817c0b679c2e20dc16e1f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_271d61939618", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "271d61939618", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-45-65281-5-13-23-16-18-65037-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789785610, "last_seen": 1789785610, "transport": "t", "ja3_hash": "d6ff2c8de312c8e4726d316d93b53940", "ja3_variant_count": 1, "ja3_variants": [ "d6ff2c8de312c8e4726d316d93b53940" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_3d832be87f33", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "3d832be87f33", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-13-5-0-65281-16-10-27-65037-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789694715, "last_seen": 1789694715, "transport": "t", "ja3_hash": "299e3f88f6ad63901ebab098429c185a", "ja3_variant_count": 1, "ja3_variants": [ "299e3f88f6ad63901ebab098429c185a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_4e347bfd433f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "4e347bfd433f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51764-0-5-45-27-17613-16-65037-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789679048, "last_seen": 1789679048, "transport": "t", "ja3_hash": "606116c78c0693957de0e62e259ce341", "ja3_variant_count": 1, "ja3_variants": [ "606116c78c0693957de0e62e259ce341" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_ebb0d8e3ac2c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "ebb0d8e3ac2c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-35-10-18-16-13-11-27-45-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789556199, "last_seen": 1789556199, "transport": "t", "ja3_hash": "2aa20a7b6cabedec58dbed4144ad8c3a", "ja3_variant_count": 1, "ja3_variants": [ "2aa20a7b6cabedec58dbed4144ad8c3a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_7c17162d57c3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "7c17162d57c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-17613-27-23-18-45-51764-65281-10-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789641496, "last_seen": 1789641496, "transport": "t", "ja3_hash": "f01b2a53a4f6ec50bf1f72523d80026c", "ja3_variant_count": 1, "ja3_variants": [ "f01b2a53a4f6ec50bf1f72523d80026c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_d735600089ac", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "d735600089ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-0-51764-17613-5-65281-11-65037-10-35-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789913350, "last_seen": 1789913350, "transport": "t", "ja3_hash": "aff45240c140b56feee7ae1c3f442d37", "ja3_variant_count": 1, "ja3_variants": [ "aff45240c140b56feee7ae1c3f442d37" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_ee0f559d2348", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "ee0f559d2348", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-17613-65037-5-10-13-18-35-0-45-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788777967, "last_seen": 1788777967, "transport": "t", "ja3_hash": "559b2aa773918be4de811f952bda1f60", "ja3_variant_count": 1, "ja3_variants": [ "559b2aa773918be4de811f952bda1f60" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_20aa904ea21f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "20aa904ea21f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-51764-16-17613-35-27-0-11-18-45-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789929113, "last_seen": 1789929113, "transport": "t", "ja3_hash": "e0f795b5a69aff27c26cc454f9696f2c", "ja3_variant_count": 1, "ja3_variants": [ "e0f795b5a69aff27c26cc454f9696f2c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_3e2fb2398056", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "3e2fb2398056", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-45-5-11-65281-0-10-51764-18-16-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789231689, "last_seen": 1789231689, "transport": "t", "ja3_hash": "456943480ad94605c42d69e7c11d78dd", "ja3_variant_count": 1, "ja3_variants": [ "456943480ad94605c42d69e7c11d78dd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_5c6fb5164846", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "5c6fb5164846", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-35-18-45-11-13-16-65281-65037-51764-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789739406, "last_seen": 1789739406, "transport": "t", "ja3_hash": "26fb5abdc6c44e7b99457f5b054e716c", "ja3_variant_count": 1, "ja3_variants": [ "26fb5abdc6c44e7b99457f5b054e716c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_6f5c1e5c2f55", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "6f5c1e5c2f55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-35-13-23-0-18-45-27-10-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789556197, "last_seen": 1789556197, "transport": "t", "ja3_hash": "6bacacf19c64057ebcfe33f8c5eb13a8", "ja3_variant_count": 1, "ja3_variants": [ "6bacacf19c64057ebcfe33f8c5eb13a8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_81a3b5c0dbca", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "81a3b5c0dbca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,65281-0-16-45-35-27-65037-10-5-13-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789719568, "last_seen": 1789719568, "transport": "t", "ja3_hash": "09e5db25d380dc87ea219e405f3737fc", "ja3_variant_count": 1, "ja3_variants": [ "09e5db25d380dc87ea219e405f3737fc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_861e9dcdcffc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "861e9dcdcffc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-16-11-0-23-10-18-13-65281-5-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788643392, "last_seen": 1788643392, "transport": "t", "ja3_hash": "eeab3b080223d0edf7f620094e81d23a", "ja3_variant_count": 1, "ja3_variants": [ "eeab3b080223d0edf7f620094e81d23a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_a4afb8a89362", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "a4afb8a89362", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-5-16-10-35-45-13-0-65037-17613-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789662843, "last_seen": 1789662843, "transport": "t", "ja3_hash": "d3176712361445a7362d981f40741f31", "ja3_variant_count": 1, "ja3_variants": [ "d3176712361445a7362d981f40741f31" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_b0592e302592", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "b0592e302592", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-65281-0-16-10-11-18-23-65037-45-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788854159, "last_seen": 1788854159, "transport": "t", "ja3_hash": "8d8754490638565586a954ada1aab2ab", "ja3_variant_count": 1, "ja3_variants": [ "8d8754490638565586a954ada1aab2ab" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_ba3e74145d2d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "ba3e74145d2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-18-16-35-27-10-65037-0-23-17613-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789885584, "last_seen": 1789885584, "transport": "t", "ja3_hash": "2c86f9fb3f754b0e13c6d04c9bfea2e4", "ja3_variant_count": 1, "ja3_variants": [ "2c86f9fb3f754b0e13c6d04c9bfea2e4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_d323c33fb431", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "d323c33fb431", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-11-65281-5-65037-27-0-13-10-23-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789722982, "last_seen": 1789722982, "transport": "t", "ja3_hash": "a8eba56a3cf097bd4bb43e6b572a1e58", "ja3_variant_count": 1, "ja3_variants": [ "a8eba56a3cf097bd4bb43e6b572a1e58" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151400_8daaf6152771_c3dd6200a952", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151400", "b": "8daaf6152771", "c": "c3dd6200a952", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-45-35-11-23-0-17613-65037-13-51764-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789436554, "last_seen": 1789436554, "transport": "t", "ja3_hash": "637557be4d821bad2b422fdbd4215910", "ja3_variant_count": 1, "ja3_variants": [ "637557be4d821bad2b422fdbd4215910" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_25a14435e36a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "25a14435e36a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-13-65281-27-0-51764-45-5-16-65037-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789820710, "last_seen": 1789820710, "transport": "t", "ja3_hash": "b15eae16d73bd729a272afff384c7289", "ja3_variant_count": 1, "ja3_variants": [ "b15eae16d73bd729a272afff384c7289" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_793f6c46d541", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "793f6c46d541", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-65037-35-13-27-18-11-65281-51764-23-16-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789744523, "last_seen": 1789744523, "transport": "t", "ja3_hash": "137ca73fc639d8a0ab6355ddb7795a81", "ja3_variant_count": 1, "ja3_variants": [ "137ca73fc639d8a0ab6355ddb7795a81" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_e6c9a88f42b5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "e6c9a88f42b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-65037-10-23-13-0-11-16-5-27-45-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789931571, "last_seen": 1789931571, "transport": "t", "ja3_hash": "479eed5204ec3c2832b9ba53e1b8bcb5", "ja3_variant_count": 1, "ja3_variants": [ "479eed5204ec3c2832b9ba53e1b8bcb5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_f442e4d23ff6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "f442e4d23ff6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-16-10-18-65281-11-65037-13-23-17613-35-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788535998, "last_seen": 1788535998, "transport": "t", "ja3_hash": "d644b4ca8dff5435d08dc38fe5fa0aa1", "ja3_variant_count": 1, "ja3_variants": [ "d644b4ca8dff5435d08dc38fe5fa0aa1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_03a19d5278e6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "03a19d5278e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-10-0-16-17613-65281-18-5-65037-45-27-13-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789732684, "last_seen": 1789732684, "transport": "t", "ja3_hash": "83cdb5f80d5f3f98a8bbb11e31737834", "ja3_variant_count": 1, "ja3_variants": [ "83cdb5f80d5f3f98a8bbb11e31737834" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_09ce68a64ac1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "09ce68a64ac1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-18-45-17613-10-27-23-0-5-13-65037-65281-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027383, "last_seen": 1789027383, "transport": "t", "ja3_hash": "2d6922e024f15518a6bf5e57b8ba9444", "ja3_variant_count": 1, "ja3_variants": [ "2d6922e024f15518a6bf5e57b8ba9444" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_0c4b4c30d0dd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "0c4b4c30d0dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-65037-11-27-51764-0-10-16-45-18-35-17613-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788461895, "last_seen": 1788461895, "transport": "t", "ja3_hash": "7cb721a109b60dfd7fa6cb962b2a96c2", "ja3_variant_count": 1, "ja3_variants": [ "7cb721a109b60dfd7fa6cb962b2a96c2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_0d9c62265aa3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "0d9c62265aa3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-13-11-18-51764-65037-45-17613-0-5-27-16-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789240093, "last_seen": 1789240093, "transport": "t", "ja3_hash": "b500a9576e9ab62fb228b77280d024e5", "ja3_variant_count": 1, "ja3_variants": [ "b500a9576e9ab62fb228b77280d024e5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_37a7dc93cc8c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "37a7dc93cc8c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-65037-16-18-10-65281-11-0-27-35-51764-45-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788967490, "last_seen": 1788967490, "transport": "t", "ja3_hash": "8d56aaa34f2bb69f2759981e2434f534", "ja3_variant_count": 1, "ja3_variants": [ "8d56aaa34f2bb69f2759981e2434f534" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_5e2165e4963a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "5e2165e4963a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-23-13-10-11-65281-18-35-5-17613-0-65037-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788897973, "last_seen": 1788897973, "transport": "t", "ja3_hash": "cf66d0816002f228a47aca3f9de63ff6", "ja3_variant_count": 1, "ja3_variants": [ "cf66d0816002f228a47aca3f9de63ff6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_6cbde9051cc0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "6cbde9051cc0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,23-13-16-65281-18-0-51764-45-35-5-27-11-17613-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788887852, "last_seen": 1788887852, "transport": "t", "ja3_hash": "fb9d246e89c0b5ee85d282a1ddeeabc1", "ja3_variant_count": 1, "ja3_variants": [ "fb9d246e89c0b5ee85d282a1ddeeabc1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_7645b50074e1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "7645b50074e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-27-10-17613-18-0-16-23-65281-11-5-51764-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789026974, "last_seen": 1789026974, "transport": "t", "ja3_hash": "7af2391a26de63b09bfb81a45df54387", "ja3_variant_count": 1, "ja3_variants": [ "7af2391a26de63b09bfb81a45df54387" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1516h2_8daaf6152771_2d9ee4d0ad3f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1516h2", "b": "8daaf6152771", "c": "2d9ee4d0ad3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-16-11-5-65281-13-51764-65037-23-17613-27-45-0-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789034267, "last_seen": 1789034267, "transport": "t", "ja3_hash": "67637063997e0c421ae3406e456c14a6", "ja3_variant_count": 1, "ja3_variants": [ "67637063997e0c421ae3406e456c14a6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1516h2_8daaf6152771_6ba66e7c09ab", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1516h2", "b": "8daaf6152771", "c": "6ba66e7c09ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-18-51764-0-35-65037-4832-23-5-16-13-45-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789701026, "last_seen": 1789701026, "transport": "t", "ja3_hash": "c1e48179ed2c4d4693c6f99584d68b66", "ja3_variant_count": 1, "ja3_variants": [ "c1e48179ed2c4d4693c6f99584d68b66" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d160800_8cdfa2d4673b_b80abeb657b1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d160800", "b": "8cdfa2d4673b", "c": "b80abeb657b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 16, "extension_count": 8, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10,0-5-10-11-13-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 96, "first_seen": 1787495087, "last_seen": 1789949890, "transport": "t", "ja3_hash": "a4af752b7cb5ef242a98c0c7f446a96d", "ja3_variant_count": 1, "ja3_variants": [ "a4af752b7cb5ef242a98c0c7f446a96d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d161000_bac3852d4616_71776a6e6e2b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d161000", "b": "bac3852d4616", "c": "71776a6e6e2b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 16, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49196-156-157-49200-52392-49187-60-49195-49199-52393-49191-10-49162-49159-49161-47,21-13-18-5-11-65281-35-23-0-10,23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 21, "name": "padding", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789502866, "last_seen": 1789502866, "transport": "t", "ja3_hash": "bff455a0da7a6ca1640648a58d6693ef", "ja3_variant_count": 1, "ja3_variants": [ "bff455a0da7a6ca1640648a58d6693ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d180800_4b22cbed5bed_62f610611f10", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d180800", "b": "4b22cbed5bed", "c": "62f610611f10", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-5-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787594710, "last_seen": 1789665774, "transport": "t", "ja3_hash": "258a5a1e95b8a911872bae9081526644", "ja3_variant_count": 1, "ja3_variants": [ "258a5a1e95b8a911872bae9081526644" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1809h2_4da576aed5c1_6dadff81672f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1809h2", "b": "4da576aed5c1", "c": "6dadff81672f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,52392-60-49196-49191-49199-49200-49187-52393-49195-156-157-47-53-49169-49170-49161-49162-10,5-18-23-13-10-0-35-16-11,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789802343, "last_seen": 1789802343, "transport": "t", "ja3_hash": "7cbde9699d7dec06cb8bfb098efcc0a1", "ja3_variant_count": 1, "ja3_variants": [ "7cbde9699d7dec06cb8bfb098efcc0a1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d190600_826a7383a64d_66cfc59077e0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d190600", "b": "826a7383a64d", "c": "66cfc59077e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49195-49199-158-49162-49161-49171-49172-49159-49169-51-50-57-156-47-53-10-5-4-255,0-11-10-35-13-15,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 21, "first_seen": 1787488238, "last_seen": 1789907327, "transport": "t", "ja3_hash": "1885aa9927f99ed538ed895d9335995c", "ja3_variant_count": 1, "ja3_variants": [ "1885aa9927f99ed538ed895d9335995c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d190700_724f0b7e6496_dead13803058", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d190700", "b": "724f0b7e6496", "c": "dead13803058", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49192-49187-49191-107-103-49162-49172-49161-49171-57-51-255,0-10-11-23-35-13-45,29-23-24-25-30,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789588220, "last_seen": 1789588220, "transport": "t", "ja3_hash": "cae1b13191e105f49d96a781c7dd74ef", "ja3_variant_count": 1, "ja3_variants": [ "cae1b13191e105f49d96a781c7dd74ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d190800_d83cc789557e_62f610611f10", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d190800", "b": "d83cc789557e", "c": "62f610611f10", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 87, "first_seen": 1787558095, "last_seen": 1789795199, "transport": "t", "ja3_hash": "a0e9f5d64349fb13191bc781f81f42e1", "ja3_variant_count": 1, "ja3_variants": [ "a0e9f5d64349fb13191bc781f81f42e1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d200600_19d7ba6ed342_617aa96a424f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d200600", "b": "19d7ba6ed342", "c": "617aa96a424f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 20, "extension_count": 6, "alpn": null } }, "ja3_string": "771,157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-150-65-5-10-255,0-35-5-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787825505, "last_seen": 1789615156, "transport": "t", "ja3_hash": "e7b042ca84c354ea70e87678c32bb511", "ja3_variant_count": 1, "ja3_variants": [ "e7b042ca84c354ea70e87678c32bb511" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d2007h2_a8b3e4156f07_2eb009e832fe", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d2007h2", "b": "a8b3e4156f07", "c": "2eb009e832fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 20, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,157-60-156-49199-49196-49200-52392-49191-52393-49195-49162-49169-49171-5-49159-49170-49172-47-53-10,35-5-0-11-13-16-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789662155, "last_seen": 1789662155, "transport": "t", "ja3_hash": "7279fc31fe63c80a8d97fb972ef15c02", "ja3_variant_count": 1, "ja3_variants": [ "7279fc31fe63c80a8d97fb972ef15c02" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d210400_89c2427e67e4_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d210400", "b": "89c2427e67e4", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 21, "extension_count": 4, "alpn": null } }, "ja3_string": "771,157-61-53-132-156-60-47-150-65-7-5-4-10-9-8-6-3-59-2-1-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 12, "first_seen": 1787825500, "last_seen": 1789615155, "transport": "t", "ja3_hash": "87e9cd9ca0d10c0b01a762fdeb5691df", "ja3_variant_count": 1, "ja3_variants": [ "87e9cd9ca0d10c0b01a762fdeb5691df" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d210800_76e208dd3e22_465a47a21f65", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d210800", "b": "76e208dd3e22", "c": "465a47a21f65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 21, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1787842218, "last_seen": 1789587328, "transport": "t", "ja3_hash": "ce5f3254611a8c095a3d821d44539877", "ja3_variant_count": 1, "ja3_variants": [ "ce5f3254611a8c095a3d821d44539877" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d220800_560f53e7a786_b80abeb657b1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d220800", "b": "560f53e7a786", "c": "b80abeb657b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 22, "extension_count": 8, "alpn": null } }, "ja3_string": "771,10-47-53-156-157-49161-49162-49170-49171-49172-49195-49196-49199-49200-52392-52393-5-60-49159-49169-49187-49191,0-5-10-11-13-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787969617, "last_seen": 1789792894, "transport": "t", "ja3_hash": "85b6ca9145a1bfdae43699d7a116b9f5", "ja3_variant_count": 1, "ja3_variants": [ "85b6ca9145a1bfdae43699d7a116b9f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d220800_fe100e50004f_b80abeb657b1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d220800", "b": "fe100e50004f", "c": "b80abeb657b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 22, "extension_count": 8, "alpn": null } }, "ja3_string": "771,156-157-47-53-60-61-49171-49172-49191-49192-49161-49162-49187-49188-10-49170-49160-22-51-57-103-107,0-5-10-11-13-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1789325136, "last_seen": 1789325136, "transport": "t", "ja3_hash": "851be6e458e759523c0f78f6b486f484", "ja3_variant_count": 1, "ja3_variants": [ "851be6e458e759523c0f78f6b486f484" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d2210h2_560f53e7a786_befba1ae359c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d2210h2", "b": "560f53e7a786", "c": "befba1ae359c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 22, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49199-49195-157-60-49200-156-52392-49191-52393-49187-49196-49172-5-49170-49161-49159-10-49162-49169-49171-47-53,23-65281-5-16-0-35-10-18-13-11,23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788671804, "last_seen": 1788671804, "transport": "t", "ja3_hash": "9e68d5ff0f42a3d33f6ac90e7c7791cd", "ja3_variant_count": 1, "ja3_variants": [ "9e68d5ff0f42a3d33f6ac90e7c7791cd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d230800_31bea9ec6298_b80abeb657b1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d230800", "b": "31bea9ec6298", "c": "b80abeb657b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 23, "extension_count": 8, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49161-158-52392-52394-51-61-22-49162-57-49171-10-49172-156-157-47-53-49170,0-5-10-11-13-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 24, "first_seen": 1787995889, "last_seen": 1789940890, "transport": "t", "ja3_hash": "8212b3464705ca0acc33919cbace7958", "ja3_variant_count": 1, "ja3_variants": [ "8212b3464705ca0acc33919cbace7958" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d260400_c69ecbaecc6c_16266c2fce5b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d260400", "b": "c69ecbaecc6c", "c": "16266c2fce5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 26, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49196-49200-49195-49199-49188-49192-49187-49191-157-156-61-60-159-158-107-103-49162-49172-49161-49171-53-47-57-51-10-255,13-0-11-10,9-10-11-12-13-14-22-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 20, "first_seen": 1789726961, "last_seen": 1789729481, "transport": "t", "ja3_hash": "9c9bed22d2af7306848a133d025bb66a", "ja3_variant_count": 1, "ja3_variants": [ "9c9bed22d2af7306848a133d025bb66a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d270800_a2460661a67a_5d316f34096e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d270800", "b": "a2460661a67a", "c": "5d316f34096e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 27, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-13,29-23-30-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5286, "first_seen": 1787442808, "last_seen": 1789897248, "transport": "t", "ja3_hash": "1c9a15ffefdbe3d51d703fde3c4086eb", "ja3_variant_count": 1, "ja3_variants": [ "1c9a15ffefdbe3d51d703fde3c4086eb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d280700_b75078996b15_b85b7b870361", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d280700", "b": "b75078996b15", "c": "b85b7b870361", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 28, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49162-49195-52393-49161-49200-49172-49199-52392-49171-159-57-56-107-158-52394-51-50-103-22-19-157-53-61-156-47-60-10,0-23-65281-10-11-13-28,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1787771052, "last_seen": 1788528289, "transport": "t", "ja3_hash": "c8446f59cca2149cb5f56ced4b448c8d", "ja3_variant_count": 1, "ja3_variants": [ "c8446f59cca2149cb5f56ced4b448c8d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d280700_bbd4f008d9b2_122ea0d3d2f7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d280700", "b": "bbd4f008d9b2", "c": "122ea0d3d2f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 28, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-57-51-157-156-61-60-53-47-10-106-64-56-50-19,0-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1787959612, "last_seen": 1789943841, "transport": "t", "ja3_hash": "7c410ce832e848a3321432c9a82e972b", "ja3_variant_count": 1, "ja3_variants": [ "7c410ce832e848a3321432c9a82e972b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d280700_d943125447b4_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d280700", "b": "d943125447b4", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 28, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 15, "first_seen": 1787697752, "last_seen": 1789464807, "transport": "t", "ja3_hash": "871a754af286dfb70c1b53c6887c62e0", "ja3_variant_count": 1, "ja3_variants": [ "871a754af286dfb70c1b53c6887c62e0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d280800_d943125447b4_699838c0e161", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d280800", "b": "d943125447b4", "c": "699838c0e161", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 28, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-13172-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788989791, "last_seen": 1788989791, "transport": "t", "ja3_hash": "da34bf49c259ade1dcd0bf16d4215171", "ja3_variant_count": 1, "ja3_variants": [ "da34bf49c259ade1dcd0bf16d4215171" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d281000_0df5e5c63df4_dc2a3e31388b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d281000", "b": "0df5e5c63df4", "c": "dc2a3e31388b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 28, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-17-23-35-13-43-50,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789485414, "last_seen": 1789485414, "transport": "t", "ja3_hash": "e91a667db6105d9ca11ecc980cd8ff6e", "ja3_variant_count": 1, "ja3_variants": [ "e91a667db6105d9ca11ecc980cd8ff6e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d290700_fc2078a0b8c0_98c48c6649d0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d290700", "b": "fc2078a0b8c0", "c": "98c48c6649d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 29, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49195-49199-158-49196-49200-159-52393-52392-52244-52243-49161-49187-49171-49191-51-103-49162-49188-49172-49192-57-107-156-157-47-60-53-61-10,65281-0-23-35-13-11-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 22, "first_seen": 1787614739, "last_seen": 1789734101, "transport": "t", "ja3_hash": "2de42bb701d689176cd3487a44aaccab", "ja3_variant_count": 2, "ja3_variants": [ "2de42bb701d689176cd3487a44aaccab", "11e1137464a4343105031631d470cd92" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d300600_a9ca94f90404_935ee41de825", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d300600", "b": "a9ca94f90404", "c": "935ee41de825", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 30, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49192-49172-107-57-61-53-49191-49171-103-51-60-47-49200-159-157-49199-158-156-49161-49187-49162-49188-49170-22-10-49169-5-4-21-9,0-10-11-5-65281-13,23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 22, "first_seen": 1788665405, "last_seen": 1788665419, "transport": "t", "ja3_hash": "db118c9bec1363ef684b95ac91b005ad", "ja3_variant_count": 1, "ja3_variants": [ "db118c9bec1363ef684b95ac91b005ad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d310600_f3b328a90fc1_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d310600", "b": "f3b328a90fc1", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 31, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-158-162-159-163-49187-49191-49161-49171-49188-49192-49162-49172-103-107-51-57-64-106-50-56-156-157-60-61-47-53-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788053831, "last_seen": 1789878125, "transport": "t", "ja3_hash": "32926ca3e59f0413d0b98725454594f5", "ja3_variant_count": 1, "ja3_variants": [ "32926ca3e59f0413d0b98725454594f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d320400_992cb694dc73_bacfa8fa5626", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d320400", "b": "992cb694dc73", "c": "bacfa8fa5626", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 32, "extension_count": 4, "alpn": null } }, "ja3_string": "771,136-150-156-157-158-159-255-49154-49155-49156-49157-49159-49160-49161-49162-49164-49165-49166-49167-49169-49170-49171-49172-49187-49188-49191-49195-49196-49199-49200-49201-49202,0-11-10-13,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787509859, "last_seen": 1789900797, "transport": "t", "ja3_hash": "5f4b707a25de4e5f465ea53927052503", "ja3_variant_count": 1, "ja3_variants": [ "5f4b707a25de4e5f465ea53927052503" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d330600_5172cef6ed69_334f0aaed909", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d330600", "b": "5172cef6ed69", "c": "334f0aaed909", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 33, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49162-49161-49160-49192-49191-49172-49171-49170-61-60-53-47-10-49159-49169-5-4-49195-49199-156,0-5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 98, "first_seen": 1788076310, "last_seen": 1789763702, "transport": "t", "ja3_hash": "5c9e2c7e9d59662f068f51c5de5ff825", "ja3_variant_count": 1, "ja3_variants": [ "5c9e2c7e9d59662f068f51c5de5ff825" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d340200_280581216cf5_e4b0759bffdd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d340200", "b": "280581216cf5", "c": "e4b0759bffdd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 34, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4-5-10-13-16-19-22-47-48-49-50-51-53-54-55-56-57-60-61-62-63-64-65-68-69-102-103-104-105-106-107-132-135-255,0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 35, "first_seen": 1787509862, "last_seen": 1789900799, "transport": "t", "ja3_hash": "48153283a6674234e4c7ba641586ca55", "ja3_variant_count": 1, "ja3_variants": [ "48153283a6674234e4c7ba641586ca55" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d340600_498eeac4deb3_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d340600", "b": "498eeac4deb3", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 34, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-158-162-159-163-49187-49191-49161-49171-49188-49192-49162-49172-103-107-51-57-64-106-50-56-156-157-60-61-47-53-49159-49169-5-255,0-11-10-35-13-15,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789583810, "last_seen": 1789878122, "transport": "t", "ja3_hash": "71711c0feb4d0d407f7a4e10b7b1c385", "ja3_variant_count": 1, "ja3_variants": [ "71711c0feb4d0d407f7a4e10b7b1c385" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d370400_3fce34ec6c8f_5d941312bb9a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d370400", "b": "3fce34ec6c8f", "c": "5d941312bb9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 37, "extension_count": 4, "alpn": null } }, "ja3_string": "771,255-49196-49200-49188-49192-49198-49202-49190-49194-159-163-107-106-49195-49199-49187-49191-49197-49201-49189-49193-158-162-103-64-49162-49172-57-56-49157-49167-49161-49171-51-50-49156-49166,0-13-10-11,14-13-25-28-11-12-27-24-9-10-26-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787710534, "last_seen": 1789193027, "transport": "t", "ja3_hash": "216ef4b2d074458cbe1330368c85d325", "ja3_variant_count": 1, "ja3_variants": [ "216ef4b2d074458cbe1330368c85d325" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d380500_10ed599f3404_654fe63324b3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d380500", "b": "10ed599f3404", "c": "654fe63324b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 38, "extension_count": 5, "alpn": null } }, "ja3_string": "771,52393-52392-52394-49200-49196-49192-49188-49172-49162-159-107-57-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-255,0-11-10-35-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 51, "first_seen": 1787687195, "last_seen": 1789534507, "transport": "t", "ja3_hash": "047bfa6321a7921f57d5b91d04dcedaf", "ja3_variant_count": 1, "ja3_variants": [ "047bfa6321a7921f57d5b91d04dcedaf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d3805ht_10ed599f3404_4f2194e778ad", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d3805ht", "b": "10ed599f3404", "c": "4f2194e778ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 38, "extension_count": 5, "alpn": "ht" } }, "ja3_string": "771,52393-52392-52394-49200-49196-49192-49188-49172-49162-159-107-57-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-255,0-11-10-13-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787851590, "last_seen": 1788542865, "transport": "t", "ja3_hash": "c1020cdb6413396a7c2106cb216d7dad", "ja3_variant_count": 1, "ja3_variants": [ "c1020cdb6413396a7c2106cb216d7dad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d3806ht_10ed599f3404_ac7f9eb85633", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d3806ht", "b": "10ed599f3404", "c": "ac7f9eb85633", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 38, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,52393-52392-52394-49200-49196-49192-49188-49172-49162-159-107-57-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-255,0-11-10-35-13-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789893043, "last_seen": 1789893046, "transport": "t", "ja3_hash": "a90d7be7e610500140ab790873da8a2e", "ja3_variant_count": 1, "ja3_variants": [ "a90d7be7e610500140ab790873da8a2e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d400600_44c89e5422f1_a6ad5fe9ef24", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d400600", "b": "44c89e5422f1", "c": "a6ad5fe9ef24", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 40, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49160-158-157-156-49192-49191-52393-52392-52394-107-103-57-51-22-61-60-4-20-159-21-49196-49200-8-6-3,0-5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 50, "first_seen": 1787464630, "last_seen": 1789868669, "transport": "t", "ja3_hash": "1b9bb541fa237aff65acf838b154df7f", "ja3_variant_count": 1, "ja3_variants": [ "1b9bb541fa237aff65acf838b154df7f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d490600_730fb1b0ac6a_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d490600", "b": "730fb1b0ac6a", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 49, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49200-49196-49199-49195-159-158-49202-49198-49201-49197-165-161-164-160-49192-49188-49172-49162-49194-49190-49167-49157-49191-49187-49171-49161-49193-49189-49166-49156-107-105-104-57-55-54-103-63-62-51-49-48-157-156-61-53-60-47-255,0-11-10-35-13-15,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 93, "first_seen": 1787929614, "last_seen": 1789760503, "transport": "t", "ja3_hash": "fde79076cad267e37a9dc6f3f666b2d1", "ja3_variant_count": 1, "ja3_variants": [ "fde79076cad267e37a9dc6f3f666b2d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d4906ht_730fb1b0ac6a_d27d9be533b8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d4906ht", "b": "730fb1b0ac6a", "c": "d27d9be533b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 49, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,49200-49196-49199-49195-159-158-49202-49198-49201-49197-165-161-164-160-49192-49188-49172-49162-49194-49190-49167-49157-49191-49187-49171-49161-49193-49189-49166-49156-107-105-104-57-55-54-103-63-62-51-49-48-157-156-61-53-60-47-255,0-11-10-13-15-16,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 36, "first_seen": 1787826688, "last_seen": 1789478978, "transport": "t", "ja3_hash": "3ed5a566e6a60d27a09ba381962a8d8b", "ja3_variant_count": 1, "ja3_variants": [ "3ed5a566e6a60d27a09ba381962a8d8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d490700_ed211f7843e6_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d490700", "b": "ed211f7843e6", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 49, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49199-49195-49200-49196-158-162-163-159-49191-49187-49171-49161-49192-49188-49172-49162-103-51-64-107-56-57-156-157-50-49201-49197-49193-49189-49166-49156-60-47-106-49202-49198-49194-49190-49167-49157-61-53-136-135-132-69-68-65-255,0-11-10-35-13-15-21,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788972715, "last_seen": 1788972715, "transport": "t", "ja3_hash": "fff172bbdf6990354f316a39f3ef5867", "ja3_variant_count": 1, "ja3_variants": [ "fff172bbdf6990354f316a39f3ef5867" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d4907ht_730fb1b0ac6a_20308a74e42f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d4907ht", "b": "730fb1b0ac6a", "c": "20308a74e42f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 49, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,49200-49196-49199-49195-159-158-49202-49198-49201-49197-165-161-164-160-49192-49188-49172-49162-49194-49190-49167-49157-49191-49187-49171-49161-49193-49189-49166-49156-107-105-104-57-55-54-103-63-62-51-49-48-157-156-61-53-60-47-255,0-11-10-13-15-16-21,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 31, "first_seen": 1787507885, "last_seen": 1789932069, "transport": "t", "ja3_hash": "86cb13d6bbb3ac96b78b408bcfc18794", "ja3_variant_count": 1, "ja3_variants": [ "86cb13d6bbb3ac96b78b408bcfc18794" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d520600_7554301188de_a6ad5fe9ef24", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d520600", "b": "7554301188de", "c": "a6ad5fe9ef24", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 52, "extension_count": 6, "alpn": null } }, "ja3_string": "771,162-49200-22-49160-51-163-49187-10-4-52392-106-20-158-49161-50-49188-3-49169-49195-49171-107-49196-159-52394-23-47-49162-49192-18-64-19-52393-6-5-56-61-57-17-156-8-49172-53-60-49170-25-49199-102-103-49191-21-49159-157,0-5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788461579, "last_seen": 1789772926, "transport": "t", "ja3_hash": "a72c59c9a862b8f9522d96da837cd017", "ja3_variant_count": 5, "ja3_variants": [ "a72c59c9a862b8f9522d96da837cd017", "77f345bb6929f410f22cdc2cc7d5c052", "e9da4e41318323918a489cf658abff08", "17441c51b7f60ac9ceea81da25a495cc", "c322cf491f2f9418d627ab16c153646f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d560700_8aab05645947_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d560700", "b": "8aab05645947", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 56, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49200-49196-49202-49198-49199-49195-49201-49197-163-159-162-158-49192-49188-49172-49162-49194-49190-49167-49157-107-106-57-56-49191-49187-49171-49161-49193-49189-49166-49156-103-64-51-50-136-135-69-68-49170-49160-49165-49155-22-19-157-156-61-53-60-47-132-65-10-255,0-11-10-35-13-15-21,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 30, "first_seen": 1788374806, "last_seen": 1789144386, "transport": "t", "ja3_hash": "85da163441fc0c68e2bd4ad8c55c3380", "ja3_variant_count": 1, "ja3_variants": [ "85da163441fc0c68e2bd4ad8c55c3380" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d560700_99d8c53049f3_577401a16f57", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d560700", "b": "99d8c53049f3", "c": "577401a16f57", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 56, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788922362, "last_seen": 1789253281, "transport": "t", "ja3_hash": "c0220cd64849a629397a9cb68f78a0ea", "ja3_variant_count": 1, "ja3_variants": [ "c0220cd64849a629397a9cb68f78a0ea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d590600_7bd0586cbef7_6956cdc5de3d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d590600", "b": "7bd0586cbef7", "c": "6956cdc5de3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 59, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-163-159-107-106-57-56-136-135-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-162-158-103-64-51-50-154-153-69-68-49201-49197-49193-49189-49166-49156-156-60-47-150-65-49170-49160-22-19-49165-49155-10-255,0-11-10-13-15-21,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788972719, "last_seen": 1788972719, "transport": "t", "ja3_hash": "e3b2ab1f9a56f2fb4c9248f2f41631fa", "ja3_variant_count": 1, "ja3_variants": [ "e3b2ab1f9a56f2fb4c9248f2f41631fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d610700_8a10cb45a794_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d610700", "b": "8a10cb45a794", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 61, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49200-49196-49202-49198-49199-49195-49201-49197-163-159-162-158-49192-49188-49172-49162-49194-49190-49167-49157-107-106-57-56-49191-49187-49171-49161-49193-49189-49166-49156-103-64-51-50-49170-49160-49165-49155-136-135-69-68-22-19-157-156-61-53-60-47-132-65-10-49169-49159-49164-49154-5-255,0-11-10-35-13-15-21,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 253, "first_seen": 1787443282, "last_seen": 1789455994, "transport": "t", "ja3_hash": "683145f4a4104e2eb28ac44273d13469", "ja3_variant_count": 1, "ja3_variants": [ "683145f4a4104e2eb28ac44273d13469" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d620700_106a9de34958_89e5d97212f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d620700", "b": "106a9de34958", "c": "89e5d97212f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 62, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49200-49195-49199-52393-52392-163-159-162-158-52394-49327-49325-49188-49192-49162-49172-49315-49311-107-106-57-56-49326-49324-49187-49191-49161-49171-49314-49310-103-64-51-50-49267-49271-49266-49270-196-195-190-189-136-135-69-68-157-156-49313-49309-49312-49308-61-60-53-47-192-186-132-65-255,0-11-10-35-22-23-13,23,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788471650, "last_seen": 1788471650, "transport": "t", "ja3_hash": "a29b8182facd436a82a9340c60b16cac", "ja3_variant_count": 1, "ja3_variants": [ "a29b8182facd436a82a9340c60b16cac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d640800_60fcec5a41cb_3ebdebe9c84d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d640800", "b": "60fcec5a41cb", "c": "3ebdebe9c84d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-154-153-69-68-49159-49169-49160-49170-22-19-255,0-11-10-35-5-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787825503, "last_seen": 1789615155, "transport": "t", "ja3_hash": "9b9f883715ef45d4a3fe0d034e324e65", "ja3_variant_count": 1, "ja3_variants": [ "9b9f883715ef45d4a3fe0d034e324e65" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d650700_0dd215169a35_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d650700", "b": "0dd215169a35", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 65, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49200-49196-49202-49198-49199-49195-49201-49197-165-163-161-159-164-162-160-158-49192-49188-49172-49162-49194-49190-49167-49157-107-106-105-104-57-56-55-54-49191-49187-49171-49161-49193-49189-49166-49156-103-64-63-62-51-50-49-48-136-135-134-133-69-68-67-66-157-156-61-53-60-47-132-65-255,0-11-10-35-13-15-21,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 29, "first_seen": 1788106584, "last_seen": 1789880212, "transport": "t", "ja3_hash": "e0fe397a5edfba9a6facc7c7b341f4eb", "ja3_variant_count": 1, "ja3_variants": [ "e0fe397a5edfba9a6facc7c7b341f4eb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d670600_3d07528e3801_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d670600", "b": "3d07528e3801", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 67, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-57-56-55-54-49202-49198-49194-49190-49167-49157-157-61-53-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-51-50-49-48-49201-49197-49193-49189-49166-49156-156-60-47-154-153-152-151-150-7-49169-49159-49164-49154-5-4-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 12, "first_seen": 1787825503, "last_seen": 1789615158, "transport": "t", "ja3_hash": "9041d6504ebc6cc1717341964eaa16cf", "ja3_variant_count": 1, "ja3_variants": [ "9041d6504ebc6cc1717341964eaa16cf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d6912hq_ea0618708e31_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d6912hq", "b": "ea0618708e31", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "hq" } }, "ja3_string": "771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1824, "first_seen": 1787442806, "last_seen": 1789965997, "transport": "t", "ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6", "ja3_variant_count": 1, "ja3_variants": [ "db8d4ad49cb378fa370b43a61a9b06b6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d6912ht_ea0618708e31_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d6912ht", "b": "ea0618708e31", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,5-4-7-192-132-186-65-157-49313-49309-61-53-156-49312-49308-60-47-10-49169-52243-4867-4868-4869-52392-49271-49270-49249-49248-49200-49192-49172-49199-49191-49171-49170-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1833, "first_seen": 1787442807, "last_seen": 1789965998, "transport": "t", "ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283", "ja3_variant_count": 1, "ja3_variants": [ "013c30c8ce44c8b27e9ceb2a14db7283" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d720800_1b75dbf8ecb1_bccd9a762ad0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d720800", "b": "1b75dbf8ecb1", "c": "bccd9a762ad0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 72, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49199-49195-49200-49196-158-162-163-159-49191-49187-49171-49161-49192-49188-49172-49162-103-51-64-107-56-57-156-157-49326-49324-49314-49310-50-49312-49308-60-47-49327-49325-49315-49311-106-49313-49309-61-53-52393-52392-52394-49245-49249-49239-49235-49244-49248-49238-49234-49267-49271-196-195-49266-49270-190-189-136-135-69-68-49233-49232-192-186-132-65-255,0-11-10-35-22-23-13-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788750560, "last_seen": 1788750560, "transport": "t", "ja3_hash": "68485c296b23ddbea8137b9d37c1422c", "ja3_variant_count": 1, "ja3_variants": [ "68485c296b23ddbea8137b9d37c1422c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d8007h2_9cedc1f1428b_20308a74e42f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d8007h2", "b": "9cedc1f1428b", "c": "20308a74e42f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 80, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-57-56-55-54-136-135-134-133-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-51-50-49-48-154-153-152-151-69-68-67-66-49201-49197-49193-49189-49166-49156-156-60-47-150-65-49170-49160-22-19-16-13-49165-49155-10-7-255,0-11-10-13-15-16-21,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 12, "first_seen": 1787718288, "last_seen": 1789737345, "transport": "t", "ja3_hash": "84cafd5f1a72431ad419e01609614f11", "ja3_variant_count": 1, "ja3_variants": [ "84cafd5f1a72431ad419e01609614f11" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d8207ht_9c3c28c48582_20308a74e42f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d8207ht", "b": "9c3c28c48582", "c": "20308a74e42f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 82, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-57-56-55-54-136-135-134-133-129-128-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-51-50-49-48-154-153-152-151-69-68-67-66-49201-49197-49193-49189-49166-49156-156-60-47-150-65-7-49170-49160-22-19-16-13-49165-49155-10-255,0-11-10-13-15-16-21,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788675556, "last_seen": 1788675557, "transport": "t", "ja3_hash": "883a2b1c3130bbe2f31ef505214a6e5a", "ja3_variant_count": 1, "ja3_variants": [ "883a2b1c3130bbe2f31ef505214a6e5a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d860600_e18388e7f3a3_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d860600", "b": "e18388e7f3a3", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 86, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-57-56-55-54-136-135-134-133-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-51-50-49-48-154-153-152-151-69-68-67-66-49201-49197-49193-49189-49166-49156-156-60-47-150-65-7-49169-49159-49164-49154-5-4-49170-49160-22-19-16-13-49165-49155-10-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 155, "first_seen": 1787474462, "last_seen": 1789965204, "transport": "t", "ja3_hash": "fd80fa9c6120cdeea8520510f3c644ac", "ja3_variant_count": 1, "ja3_variants": [ "fd80fa9c6120cdeea8520510f3c644ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d860700_e18388e7f3a3_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d860700", "b": "e18388e7f3a3", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 86, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-57-56-55-54-136-135-134-133-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-51-50-49-48-154-153-152-151-69-68-67-66-49201-49197-49193-49189-49166-49156-156-60-47-150-65-49170-49160-22-19-16-13-49165-49155-10-7-49169-49159-49164-49154-5-4-255,0-11-10-35-13-15-21,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788218020, "last_seen": 1788514104, "transport": "t", "ja3_hash": "b3e0f4d956240eb92ec0b60867adf96b", "ja3_variant_count": 1, "ja3_variants": [ "b3e0f4d956240eb92ec0b60867adf96b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d880500_9d74d59be4ce_7562623a49ec", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d880500", "b": "9d74d59be4ce", "c": "7562623a49ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 88, "extension_count": 5, "alpn": null } }, "ja3_string": "771,7-29-47-48-49-50-51-53-54-55-56-57-60-61-62-63-64-103-104-105-106-107-150-151-152-153-154-156-157-158-159-160-161-162-163-164-165-4865-4866-4867-4868-4869-49156-49157-49161-49162-49166-49167-49171-49172-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49308-49309-49310-49311-49312-49313-49314-49315-49324-49325-49326-49327-52392-52393-52394-5815-5816-5817-5818-253-198-199,11-10-0-13-65281,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-41-256-257-258-259-260-65281-65282,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 5815, "name": "5815 (0x16b7)", "known": false }, { "value": 5816, "name": "5816 (0x16b8)", "known": false }, { "value": 5817, "name": "5817 (0x16b9)", "known": false }, { "value": 5818, "name": "5818 (0x16ba)", "known": false }, { "value": 253, "name": "253 (0x00fd)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 65281, "name": "65281 (0xff01)", "known": false }, { "value": 65282, "name": "65282 (0xff02)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 13, "first_seen": 1789653169, "last_seen": 1789654760, "transport": "t", "ja3_hash": "d7a0d03c05a2dcaaf006ce4b2754bdb2", "ja3_variant_count": 1, "ja3_variants": [ "d7a0d03c05a2dcaaf006ce4b2754bdb2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990500_039a0bf59e5c_7562623a49ec", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990500", "b": "039a0bf59e5c", "c": "7562623a49ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 5, "alpn": null } }, "ja3_string": "771,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-96-97-98-99-100-101-102-103-104-105-106-107-108-109-128-129-130-131-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-4865-4866-4867-4868-4869-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-52392-52393-52394-52395-52396-52397-52398-5815-5816-5817-5818-253-65413-65415-198-199,11-10-0-13-65281,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-41-256-257-258-259-260-65281-65282,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 5815, "name": "5815 (0x16b7)", "known": false }, { "value": 5816, "name": "5816 (0x16b8)", "known": false }, { "value": 5817, "name": "5817 (0x16b9)", "known": false }, { "value": 5818, "name": "5818 (0x16ba)", "known": false }, { "value": 253, "name": "253 (0x00fd)", "known": false }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 65415, "name": "65415 (0xff87)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 65281, "name": "65281 (0xff01)", "known": false }, { "value": 65282, "name": "65282 (0xff02)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 13, "first_seen": 1789653165, "last_seen": 1789654756, "transport": "t", "ja3_hash": "fefd4a7b4aa70ca1608794ffdaaa04d6", "ja3_variant_count": 1, "ja3_variants": [ "fefd4a7b4aa70ca1608794ffdaaa04d6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990500_41a9ebd02c1f_7562623a49ec", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990500", "b": "41a9ebd02c1f", "c": "7562623a49ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 5, "alpn": null } }, "ja3_string": "771,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-71-72-73-74-75-76-78-79-80-81-82-83-84-85-86-87-88-89-90-91-92-96-97-98-99-100-101-102-103-104-105-106-107-108-109-128-129-130-131-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-4865-4866-4867-4868-4869-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-52242-52243-52244-52245-52246-52247-52248-52249-52392-52393-52394-52395-52396-52397-52398-5815-5816-5817-5818-253-65413-65415-198-199,11-10-0-13-65281,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-41-256-257-258-259-260-65281-65282,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 52242, "name": "52242 (0xcc12)", "known": false }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52246, "name": "52246 (0xcc16)", "known": false }, { "value": 52247, "name": "52247 (0xcc17)", "known": false }, { "value": 52248, "name": "52248 (0xcc18)", "known": false }, { "value": 52249, "name": "52249 (0xcc19)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 5815, "name": "5815 (0x16b7)", "known": false }, { "value": 5816, "name": "5816 (0x16b8)", "known": false }, { "value": 5817, "name": "5817 (0x16b9)", "known": false }, { "value": 5818, "name": "5818 (0x16ba)", "known": false }, { "value": 253, "name": "253 (0x00fd)", "known": false }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 65415, "name": "65415 (0xff87)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 65281, "name": "65281 (0xff01)", "known": false }, { "value": 65282, "name": "65282 (0xff02)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 104, "first_seen": 1789653169, "last_seen": 1789654766, "transport": "t", "ja3_hash": "4a956b53a6e8d558759f630bc0d2540b", "ja3_variant_count": 3, "ja3_variants": [ "4a956b53a6e8d558759f630bc0d2540b", "14e0e325f758db57c72d1b9042cd0efa", "27fd80ee2d5a158a738ce596864abcc5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990500_e91dfaae0f87_7562623a49ec", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990500", "b": "e91dfaae0f87", "c": "7562623a49ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 5, "alpn": null } }, "ja3_string": "771,1-2-4-5-7-9-10-12-13-15-16-18-19-21-22-28-29-47-48-49-50-51-53-54-55-56-57-59-60-61-62-63-64-102-103-104-105-106-107-150-151-152-153-154-156-157-158-159-160-161-162-163-164-165-4865-4866-4867-4868-4869-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49308-49309-49310-49311-49312-49313-49314-49315-49324-49325-49326-49327-52392-52393-52394-5815-5816-5817-5818-253-198-199,11-10-0-13-65281,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-41-256-257-258-259-260-65281-65282,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 5815, "name": "5815 (0x16b7)", "known": false }, { "value": 5816, "name": "5816 (0x16b8)", "known": false }, { "value": 5817, "name": "5817 (0x16b9)", "known": false }, { "value": 5818, "name": "5818 (0x16ba)", "known": false }, { "value": 253, "name": "253 (0x00fd)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 65281, "name": "65281 (0xff01)", "known": false }, { "value": 65282, "name": "65282 (0xff02)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 13, "first_seen": 1789653169, "last_seen": 1789654760, "transport": "t", "ja3_hash": "a7fbfe260eab66c63e9dde2c2dd50d83", "ja3_variant_count": 1, "ja3_variants": [ "a7fbfe260eab66c63e9dde2c2dd50d83" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990500_ecf6b0aa1042_7562623a49ec", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990500", "b": "ecf6b0aa1042", "c": "7562623a49ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 5, "alpn": null } }, "ja3_string": "771,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-96-97-98-99-100-101-102-103-104-105-106-107-108-109-128-129-130-131-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-4865-4866-4867-4868-4869-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-52392-52393-52394-52395-52396-52397-52398-5815-5816-5817-5818-253-65413-65415-198-199,11-10-0-13-65281,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-41-256-257-258-259-260-65281-65282,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 5815, "name": "5815 (0x16b7)", "known": false }, { "value": 5816, "name": "5816 (0x16b8)", "known": false }, { "value": 5817, "name": "5817 (0x16b9)", "known": false }, { "value": 5818, "name": "5818 (0x16ba)", "known": false }, { "value": 253, "name": "253 (0x00fd)", "known": false }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 65415, "name": "65415 (0xff87)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 65281, "name": "65281 (0xff01)", "known": false }, { "value": 65282, "name": "65282 (0xff02)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 13, "first_seen": 1789653172, "last_seen": 1789654763, "transport": "t", "ja3_hash": "bb5870ded0eb2a02b44ad01aa4caa20d", "ja3_variant_count": 1, "ja3_variants": [ "bb5870ded0eb2a02b44ad01aa4caa20d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990700_9839e1f8b32d_91c50624ef9b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990700", "b": "9839e1f8b32d", "c": "91c50624ef9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 7, "alpn": null } }, "ja3_string": "771,52244-52243-52245-49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-57-56-55-54-49271-49267-196-195-194-193-136-135-134-133-49177-167-109-58-197-137-49202-49198-49194-49190-49167-49157-49273-49269-157-61-53-192-132-149-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-51-50-49-48-49270-49266-190-189-188-187-154-153-152-151-69-68-67-66-49176-166-108-52-191-155-70-49201-49197-49193-49189-49166-49156-49272-49268-156-60-47-186-150-65-7-148-49169-49159-102-49174-24-49164-49154-5-4-146-49170-49160-22-19-16-13-49175-27-49165-49155-10-147-99-21-18-15-12-26-98-9-97-101-100-96-20-17-14-11-25-8-6-23-3-49173-49168-49158-49163-49153-59-2-1-255,0-11-10-35-13-5-15,14-13-25-28-11-12-27-24-9-10-26-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787663874, "last_seen": 1789368888, "transport": "t", "ja3_hash": "49826454e14fe89f32bec2f79ddadf73", "ja3_variant_count": 1, "ja3_variants": [ "49826454e14fe89f32bec2f79ddadf73" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990700_a40d17a72bcb_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990700", "b": "a40d17a72bcb", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 7, "alpn": null } }, "ja3_string": "771,5-4-2-1-22-51-57-58-24-53-10-27-47-52-49168-49158-49173-49163-49153-59-49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-56-55-54-136-135-134-133-49177-167-109-137-49202-49198-49194-49190-49167-49157-157-61-132-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-50-49-48-154-153-152-151-69-68-67-66-49176-166-108-155-70-49201-49197-49193-49189-49166-49156-156-60-150-65-7-49169-49159-49174-49164-49154-49170-49160-19-16-13-49175-49165-49155-255,0-11-10-35-13-15-21,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789126199, "last_seen": 1789608542, "transport": "t", "ja3_hash": "4ea9b75df5b825f5f735af30836da87d", "ja3_variant_count": 1, "ja3_variants": [ "4ea9b75df5b825f5f735af30836da87d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990700_ffeaddab04ac_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990700", "b": "ffeaddab04ac", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 7, "alpn": null } }, "ja3_string": "771,5-4-2-8-20-3-1-21-6-22-23-51-57-25-58-26-24-53-9-10-27-47-52-49168-49158-49173-49163-49153-59-49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-56-55-54-136-135-134-133-49177-167-109-137-49202-49198-49194-49190-49167-49157-157-61-132-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-50-49-48-154-153-152-151-69-68-67-66-49176-166-108-155-70-49201-49197-49193-49189-49166-49156-156-60-150-65-7-49169-49159-49174-49164-49154-49170-49160-19-16-13-49175-49165-49155-18-15-12-17-255,0-11-10-35-13-15-21,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789066057, "last_seen": 1789688221, "transport": "t", "ja3_hash": "cd42c9a128a181f95ce2f309c857061c", "ja3_variant_count": 1, "ja3_variants": [ "cd42c9a128a181f95ce2f309c857061c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i0808h2_c9d1e06f98c4_ac6a06c2a0bd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i0808h2", "b": "c9d1e06f98c4", "c": "ac6a06c2a0bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,52393-52392-49195-49199-49196-49200-156-157,43-10-13-16-23-22-65281-35,23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 63, "first_seen": 1787497773, "last_seen": 1789961360, "transport": "t", "ja3_hash": "857aea9be2f35c272d23f3c4e0deefaa", "ja3_variant_count": 1, "ja3_variants": [ "857aea9be2f35c272d23f3c4e0deefaa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i0808ht_c9d1e06f98c4_ac6a06c2a0bd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i0808ht", "b": "c9d1e06f98c4", "c": "ac6a06c2a0bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,49195-49196-49199-49200-52393-52392-156-157,43-10-13-16-23-22-65281-35,23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 64, "first_seen": 1787497805, "last_seen": 1789961360, "transport": "t", "ja3_hash": "a7da2bc4375750ea67e9e97d561b1fdd", "ja3_variant_count": 1, "ja3_variants": [ "a7da2bc4375750ea67e9e97d561b1fdd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i0809h2_c9d1e06f98c4_199b71c7db97", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i0809h2", "b": "c9d1e06f98c4", "c": "199b71c7db97", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,52393-49196-49195-52392-49200-49199-157-156,43-10-13-16-23-22-65281-35-28,24-23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 64, "first_seen": 1787497704, "last_seen": 1789961361, "transport": "t", "ja3_hash": "845637b65493166751bd102deb9f9116", "ja3_variant_count": 1, "ja3_variants": [ "845637b65493166751bd102deb9f9116" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_7ca2e5979b2a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "7ca2e5979b2a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1787890558, "last_seen": 1789112204, "transport": "t", "ja3_hash": "9ec7db6e71a7c361ca8c41f85728dc73", "ja3_variant_count": 1, "ja3_variants": [ "9ec7db6e71a7c361ca8c41f85728dc73" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_c97aa4dd9f5a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "c97aa4dd9f5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789587743, "last_seen": 1789587743, "transport": "t", "ja3_hash": "cdd0d1eef18d0a55a0072b01af2dd2b0", "ja3_variant_count": 1, "ja3_variants": [ "cdd0d1eef18d0a55a0072b01af2dd2b0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_66e0d15328ae", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "66e0d15328ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788776671, "last_seen": 1788776671, "transport": "t", "ja3_hash": "f0f211e6ed5646282f792dbafc0c0113", "ja3_variant_count": 1, "ja3_variants": [ "f0f211e6ed5646282f792dbafc0c0113" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_85cf7a6ef633", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "85cf7a6ef633", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-51-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789414881, "last_seen": 1789414881, "transport": "t", "ja3_hash": "b278033f2addcce3a41e41e059f33716", "ja3_variant_count": 1, "ja3_variants": [ "b278033f2addcce3a41e41e059f33716" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_d5ca406f6f55", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "d5ca406f6f55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789416158, "last_seen": 1789416158, "transport": "t", "ja3_hash": "b459f736577a637b62f2b84b34f62a77", "ja3_variant_count": 1, "ja3_variants": [ "b459f736577a637b62f2b84b34f62a77" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_dc67962036b3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "dc67962036b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789283191, "last_seen": 1789283191, "transport": "t", "ja3_hash": "42861abf67b2117e98a93c224c5f955c", "ja3_variant_count": 1, "ja3_variants": [ "42861abf67b2117e98a93c224c5f955c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_e8048a751f68", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "e8048a751f68", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789050369, "last_seen": 1789050369, "transport": "t", "ja3_hash": "d86ddb057cf320f75f9edf79a056fb28", "ja3_variant_count": 1, "ja3_variants": [ "d86ddb057cf320f75f9edf79a056fb28" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_05cfb8aa73db", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "05cfb8aa73db", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-16-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789865343, "last_seen": 1789865343, "transport": "t", "ja3_hash": "fe5cbb386261e20791e8edc81d66b7bc", "ja3_variant_count": 1, "ja3_variants": [ "fe5cbb386261e20791e8edc81d66b7bc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_0f2ec705819d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "0f2ec705819d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-51764-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789240529, "last_seen": 1789240529, "transport": "t", "ja3_hash": "86760cb6fee326997b0b7d5a5579a756", "ja3_variant_count": 1, "ja3_variants": [ "86760cb6fee326997b0b7d5a5579a756" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_2a184be5a224", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "2a184be5a224", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-16-23-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789796845, "last_seen": 1789796845, "transport": "t", "ja3_hash": "8e53d016edd23f360f72e6f32f78c933", "ja3_variant_count": 1, "ja3_variants": [ "8e53d016edd23f360f72e6f32f78c933" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_697ffc8436c8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "697ffc8436c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-35-16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789565246, "last_seen": 1789565246, "transport": "t", "ja3_hash": "3cd216db87181c78160d9e8c21b9cba0", "ja3_variant_count": 1, "ja3_variants": [ "3cd216db87181c78160d9e8c21b9cba0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_79a046205eef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "79a046205eef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788988737, "last_seen": 1788988737, "transport": "t", "ja3_hash": "d4c28a9edd20a8e10d42034d4f34a7bf", "ja3_variant_count": 1, "ja3_variants": [ "d4c28a9edd20a8e10d42034d4f34a7bf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_7c90efbf5543", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "7c90efbf5543", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788812135, "last_seen": 1788812135, "transport": "t", "ja3_hash": "9e3806f7b1423d65c1f0d9707b06e2bd", "ja3_variant_count": 1, "ja3_variants": [ "9e3806f7b1423d65c1f0d9707b06e2bd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_979e2dce12af", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "979e2dce12af", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-16-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788775537, "last_seen": 1788775537, "transport": "t", "ja3_hash": "6c3e86f548547fc8301615816bf9b755", "ja3_variant_count": 1, "ja3_variants": [ "6c3e86f548547fc8301615816bf9b755" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_a3e81914eb93", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "a3e81914eb93", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789015035, "last_seen": 1789015035, "transport": "t", "ja3_hash": "1eecb0bb1aa59767842fb6bd272b2ac2", "ja3_variant_count": 1, "ja3_variants": [ "1eecb0bb1aa59767842fb6bd272b2ac2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_afda78a8b431", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "afda78a8b431", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-65281-16-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789702110, "last_seen": 1789702110, "transport": "t", "ja3_hash": "6509d806a870ff8029c75b16c90bf47d", "ja3_variant_count": 1, "ja3_variants": [ "6509d806a870ff8029c75b16c90bf47d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_aff3deea7f12", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "aff3deea7f12", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789497607, "last_seen": 1789497607, "transport": "t", "ja3_hash": "85ffbb0edaa858edf1e5172661e4a72f", "ja3_variant_count": 1, "ja3_variants": [ "85ffbb0edaa858edf1e5172661e4a72f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_bf91c976a911", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "bf91c976a911", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-65281-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789400298, "last_seen": 1789400298, "transport": "t", "ja3_hash": "0b666e7fbd73c8320f6dd319738a7d23", "ja3_variant_count": 1, "ja3_variants": [ "0b666e7fbd73c8320f6dd319738a7d23" ], "user_agents": { "PromptingBot/1.0.0": 23 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_e452696aae62", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "e452696aae62", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51764-16-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015043, "last_seen": 1789015043, "transport": "t", "ja3_hash": "821edd21b3ee76db0cb7f8959b73f7c8", "ja3_variant_count": 1, "ja3_variants": [ "821edd21b3ee76db0cb7f8959b73f7c8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_e73a38c48156", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "e73a38c48156", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-65281-51-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015037, "last_seen": 1789015037, "transport": "t", "ja3_hash": "b4bb526d35fe15e7f5684797e7cc58c9", "ja3_variant_count": 1, "ja3_variants": [ "b4bb526d35fe15e7f5684797e7cc58c9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_efdcf0f9a773", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "efdcf0f9a773", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-27-65281-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391196, "last_seen": 1789391196, "transport": "t", "ja3_hash": "48c9a16366ab078b1cba4cd5f0cbbf69", "ja3_variant_count": 1, "ja3_variants": [ "48c9a16366ab078b1cba4cd5f0cbbf69" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505ht_8daaf6152771_69fc4e9b284e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505ht", "b": "8daaf6152771", "c": "69fc4e9b284e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-16-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789026334, "last_seen": 1789026334, "transport": "t", "ja3_hash": "909b1f4b6400ab155719a32e963b5536", "ja3_variant_count": 1, "ja3_variants": [ "909b1f4b6400ab155719a32e963b5536" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_0965147a6f52", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "0965147a6f52", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-65281-18-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789415564, "last_seen": 1789415564, "transport": "t", "ja3_hash": "6f4c7a4c5f7bf288a5394be8db6a00af", "ja3_variant_count": 1, "ja3_variants": [ "6f4c7a4c5f7bf288a5394be8db6a00af" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_317b1abd98bf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "317b1abd98bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-51764-23-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788778767, "last_seen": 1788778767, "transport": "t", "ja3_hash": "8b3269063f561862b003bf934c315c6f", "ja3_variant_count": 1, "ja3_variants": [ "8b3269063f561862b003bf934c315c6f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_745ca75e536c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "745ca75e536c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-45-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730570, "last_seen": 1789730570, "transport": "t", "ja3_hash": "4271f0e0099dbb988273bb7c6273153f", "ja3_variant_count": 1, "ja3_variants": [ "4271f0e0099dbb988273bb7c6273153f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_74759dd3ab6e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "74759dd3ab6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-51-10-18-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788876072, "last_seen": 1788876072, "transport": "t", "ja3_hash": "f0903a90e12599c4796876fc933c4434", "ja3_variant_count": 1, "ja3_variants": [ "f0903a90e12599c4796876fc933c4434" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_7acd2815969f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "7acd2815969f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-27-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789402744, "last_seen": 1789402744, "transport": "t", "ja3_hash": "5e208ec80f76000f73cb7518dce8f529", "ja3_variant_count": 1, "ja3_variants": [ "5e208ec80f76000f73cb7518dce8f529" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_b649636998cb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "b649636998cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-16-10-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789950628, "last_seen": 1789950628, "transport": "t", "ja3_hash": "134c7ba2ac0c53b5c3bbc440c2ae593c", "ja3_variant_count": 1, "ja3_variants": [ "134c7ba2ac0c53b5c3bbc440c2ae593c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_0eb7788d75df", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "0eb7788d75df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-10-16-35-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788491118, "last_seen": 1788491118, "transport": "t", "ja3_hash": "2a0e2e5bf7da374ba5954c58da1f9ae8", "ja3_variant_count": 1, "ja3_variants": [ "2a0e2e5bf7da374ba5954c58da1f9ae8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_10ed277f9ef1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "10ed277f9ef1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-27-65281-13-16-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789617353, "last_seen": 1789617353, "transport": "t", "ja3_hash": "47d33b797370a41f7cf1bcc1610f511b", "ja3_variant_count": 1, "ja3_variants": [ "47d33b797370a41f7cf1bcc1610f511b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_1566c837be95", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "1566c837be95", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-10-35-27-16-18,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788860942, "last_seen": 1788860942, "transport": "t", "ja3_hash": "16a317529e5084cf8cbe51392e4c6a23", "ja3_variant_count": 1, "ja3_variants": [ "16a317529e5084cf8cbe51392e4c6a23" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_3dc138390035", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "3dc138390035", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-23-17613-10-13-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789545192, "last_seen": 1789545192, "transport": "t", "ja3_hash": "456e59821300f0e55e6b927326d59bbb", "ja3_variant_count": 1, "ja3_variants": [ "456e59821300f0e55e6b927326d59bbb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_49f193ed448b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "49f193ed448b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-17613-27-51-23-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788932613, "last_seen": 1788932613, "transport": "t", "ja3_hash": "5d08ddf6ae475c4f353a079f7725b9c3", "ja3_variant_count": 1, "ja3_variants": [ "5d08ddf6ae475c4f353a079f7725b9c3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_4a2ceb0da223", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "4a2ceb0da223", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-10-45-23-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789867026, "last_seen": 1789867026, "transport": "t", "ja3_hash": "ea2487c2f596c01d56ed4a51f2c3c54e", "ja3_variant_count": 1, "ja3_variants": [ "ea2487c2f596c01d56ed4a51f2c3c54e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_59b96b53af19", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "59b96b53af19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-18-35-17613-16-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789062936, "last_seen": 1789062936, "transport": "t", "ja3_hash": "c7c8545cee0eab243275db648c93717e", "ja3_variant_count": 1, "ja3_variants": [ "c7c8545cee0eab243275db648c93717e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_9f989d55f075", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "9f989d55f075", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-65281-35-11-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789751594, "last_seen": 1789751594, "transport": "t", "ja3_hash": "3f5a985f1a0ea515b24d4d966aa7a3b6", "ja3_variant_count": 1, "ja3_variants": [ "3f5a985f1a0ea515b24d4d966aa7a3b6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_c6b7a2ed985f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "c6b7a2ed985f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-23-51764-18-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788911287, "last_seen": 1788911287, "transport": "t", "ja3_hash": "1d21eba3ef08a2ca8b8214cdb722940d", "ja3_variant_count": 1, "ja3_variants": [ "1d21eba3ef08a2ca8b8214cdb722940d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_e0b201ca86c8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "e0b201ca86c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-51-16-35-17613-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789949806, "last_seen": 1789949806, "transport": "t", "ja3_hash": "dcd927dcb6897a8ef66110a0d78df740", "ja3_variant_count": 1, "ja3_variants": [ "dcd927dcb6897a8ef66110a0d78df740" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_08a792c65da1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "08a792c65da1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-65281-45-16-13-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789253281, "last_seen": 1789253281, "transport": "t", "ja3_hash": "3e69c98b24f213f9bbf817d802b44f0b", "ja3_variant_count": 1, "ja3_variants": [ "3e69c98b24f213f9bbf817d802b44f0b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_1b1ce02dbc99", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "1b1ce02dbc99", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51764-18-65281-35-27-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789478092, "last_seen": 1789478092, "transport": "t", "ja3_hash": "55cfc88eb16ccca0714b4101d73eec31", "ja3_variant_count": 1, "ja3_variants": [ "55cfc88eb16ccca0714b4101d73eec31" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3225aaed9dfe", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3225aaed9dfe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-5-51-18-16-35-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788542029, "last_seen": 1788542029, "transport": "t", "ja3_hash": "6f39de4b40ace56bd6ccd970525cb922", "ja3_variant_count": 1, "ja3_variants": [ "6f39de4b40ace56bd6ccd970525cb922" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3819f89efd29", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3819f89efd29", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-65281-17613-13-16-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789582330, "last_seen": 1789582330, "transport": "t", "ja3_hash": "e9061cb290b30f850cf6d6179211625a", "ja3_variant_count": 1, "ja3_variants": [ "e9061cb290b30f850cf6d6179211625a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3bd5cb5172ba", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3bd5cb5172ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-35-13-11-5-18-23,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789931569, "last_seen": 1789931569, "transport": "t", "ja3_hash": "5a3a1c7ff03ef146a7b7630df5ea99e5", "ja3_variant_count": 1, "ja3_variants": [ "5a3a1c7ff03ef146a7b7630df5ea99e5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_541eb61b3ab1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "541eb61b3ab1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-5-11-10-65281-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789196281, "last_seen": 1789196281, "transport": "t", "ja3_hash": "d00448e8463e13e0ea57412099b1dae6", "ja3_variant_count": 1, "ja3_variants": [ "d00448e8463e13e0ea57412099b1dae6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_75d1f9c55191", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "75d1f9c55191", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-11-51764-65281-27-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788514914, "last_seen": 1788514914, "transport": "t", "ja3_hash": "7c24b9911f514f0dd77908de2ebe803c", "ja3_variant_count": 1, "ja3_variants": [ "7c24b9911f514f0dd77908de2ebe803c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_7aac7e436890", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "7aac7e436890", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-27-51-45-11-16-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789062936, "last_seen": 1789062936, "transport": "t", "ja3_hash": "7de038b0b7a974245d02f040e8d0deb6", "ja3_variant_count": 1, "ja3_variants": [ "7de038b0b7a974245d02f040e8d0deb6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_960578f014b5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "960578f014b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-11-51-65281-18-17613-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789430696, "last_seen": 1789430696, "transport": "t", "ja3_hash": "2137edc912f3080d263c333014647a75", "ja3_variant_count": 1, "ja3_variants": [ "2137edc912f3080d263c333014647a75" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_9b566607c4f6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "9b566607c4f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-11-18-65281-27-17613-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789463341, "last_seen": 1789463341, "transport": "t", "ja3_hash": "54247dff55cd67d6b1da96c8abd9cf32", "ja3_variant_count": 1, "ja3_variants": [ "54247dff55cd67d6b1da96c8abd9cf32" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_a0711822b781", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "a0711822b781", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-17613-11-27-45-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789467198, "last_seen": 1789467198, "transport": "t", "ja3_hash": "50fea6fde0e34a809ae6b502cd44bff5", "ja3_variant_count": 1, "ja3_variants": [ "50fea6fde0e34a809ae6b502cd44bff5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_a1d79d390f9f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "a1d79d390f9f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-35-10-23-51764-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789744534, "last_seen": 1789744534, "transport": "t", "ja3_hash": "f8bf0551b6389e92a5a608b508827969", "ja3_variant_count": 1, "ja3_variants": [ "f8bf0551b6389e92a5a608b508827969" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_ad4e5ebcc3e0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "ad4e5ebcc3e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-51764-65281-35-10-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788723900, "last_seen": 1788723900, "transport": "t", "ja3_hash": "241ce40399b9a6865c10447c4a3aa08e", "ja3_variant_count": 1, "ja3_variants": [ "241ce40399b9a6865c10447c4a3aa08e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_f1a111b46443", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "f1a111b46443", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-65037-23-16-11-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788448172, "last_seen": 1788448172, "transport": "t", "ja3_hash": "8abb6e244391edc262a2673650a4116a", "ja3_variant_count": 1, "ja3_variants": [ "8abb6e244391edc262a2673650a4116a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_f2f9bc6a6b49", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "f2f9bc6a6b49", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-18-35-5-16-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789847471, "last_seen": 1789847471, "transport": "t", "ja3_hash": "42b26653c2ab1df2117300ab5635481b", "ja3_variant_count": 1, "ja3_variants": [ "42b26653c2ab1df2117300ab5635481b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_0faf7d3e4c5a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "0faf7d3e4c5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-35-23-18-27-10-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789517703, "last_seen": 1789517703, "transport": "t", "ja3_hash": "f04b3d4930774f0d98b35d1f74a7b320", "ja3_variant_count": 1, "ja3_variants": [ "f04b3d4930774f0d98b35d1f74a7b320" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_65d7df6850db", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "65d7df6850db", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-18-5-23-10-65281-11-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788897836, "last_seen": 1788897836, "transport": "t", "ja3_hash": "40d8e1fe432cd900c82b6f0b9bf30fe2", "ja3_variant_count": 1, "ja3_variants": [ "40d8e1fe432cd900c82b6f0b9bf30fe2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_8720c114d136", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "8720c114d136", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-16-5-35-65037-27-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789559518, "last_seen": 1789559518, "transport": "t", "ja3_hash": "e465c4586607cea73f106f465e48c4e2", "ja3_variant_count": 1, "ja3_variants": [ "e465c4586607cea73f106f465e48c4e2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_baf35259f0a3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "baf35259f0a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-51764-65037-16-10-5-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789572029, "last_seen": 1789572029, "transport": "t", "ja3_hash": "04bf4a0b90a2230a4f16360e4d00afd2", "ja3_variant_count": 1, "ja3_variants": [ "04bf4a0b90a2230a4f16360e4d00afd2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_bd11714b9262", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "bd11714b9262", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-65281-23-17613-16-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788561632, "last_seen": 1788561632, "transport": "t", "ja3_hash": "dee18219164557a28ff35519a90b48f6", "ja3_variant_count": 1, "ja3_variants": [ "dee18219164557a28ff35519a90b48f6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_c9ac86013c8a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "c9ac86013c8a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-65281-35-45-5-23-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789676101, "last_seen": 1789676101, "transport": "t", "ja3_hash": "238985e1f7cf0110cd99a6aa072a62fe", "ja3_variant_count": 1, "ja3_variants": [ "238985e1f7cf0110cd99a6aa072a62fe" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_ea47e43b21a4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "ea47e43b21a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-65037-45-18-17613-16-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789744523, "last_seen": 1789744523, "transport": "t", "ja3_hash": "5942a0ee5a4799d5a6373a08a75e75dc", "ja3_variant_count": 1, "ja3_variants": [ "5942a0ee5a4799d5a6373a08a75e75dc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_0f1c0d585a59", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "0f1c0d585a59", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-5-65037-27-23-35-16-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789398571, "last_seen": 1789398571, "transport": "t", "ja3_hash": "e649538e50e045a5d0ed2383e1a529e7", "ja3_variant_count": 1, "ja3_variants": [ "e649538e50e045a5d0ed2383e1a529e7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_1adffa8f8dd6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "1adffa8f8dd6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-11-27-23-45-65281-51-10-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789931639, "last_seen": 1789931639, "transport": "t", "ja3_hash": "1d3273d26880e8e6bd1f857ea42b955f", "ja3_variant_count": 1, "ja3_variants": [ "1d3273d26880e8e6bd1f857ea42b955f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_8b729da37de9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "8b729da37de9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-16-10-18-45-65037-13-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789693049, "last_seen": 1789693049, "transport": "t", "ja3_hash": "ff7bc7c6de82cf9301c919546b90fd35", "ja3_variant_count": 1, "ja3_variants": [ "ff7bc7c6de82cf9301c919546b90fd35" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_8d28cf51bedc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "8d28cf51bedc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-17613-5-18-51764-27-16-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789638543, "last_seen": 1789638543, "transport": "t", "ja3_hash": "7793d00cccc3e08eb4d293c8bf81a97f", "ja3_variant_count": 1, "ja3_variants": [ "7793d00cccc3e08eb4d293c8bf81a97f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_980bfa27ccb2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "980bfa27ccb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-45-23-13-27-11-16-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788496646, "last_seen": 1788496646, "transport": "t", "ja3_hash": "ff0cf3ee399b1b589e01c06cdd180283", "ja3_variant_count": 1, "ja3_variants": [ "ff0cf3ee399b1b589e01c06cdd180283" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_ae700b083824", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "ae700b083824", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-10-16-45-5-35-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789015040, "last_seen": 1789015040, "transport": "t", "ja3_hash": "3fadcdabf2b9f8e483682ab2b545b185", "ja3_variant_count": 1, "ja3_variants": [ "3fadcdabf2b9f8e483682ab2b545b185" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_b8465e333ec7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "b8465e333ec7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-65281-18-10-5-35-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789617350, "last_seen": 1789617350, "transport": "t", "ja3_hash": "8abde88dc971b8308645868b77b19207", "ja3_variant_count": 1, "ja3_variants": [ "8abde88dc971b8308645868b77b19207" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_c094ecaabaea", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "c094ecaabaea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-17613-35-18-13-27-16-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789369479, "last_seen": 1789369479, "transport": "t", "ja3_hash": "76a76a0455c37cce4a7f86ecba591164", "ja3_variant_count": 1, "ja3_variants": [ "76a76a0455c37cce4a7f86ecba591164" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_d7ec8b2f1aa4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "d7ec8b2f1aa4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-10-11-35-65281-27-18-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788454692, "last_seen": 1788454692, "transport": "t", "ja3_hash": "4abe7b29775c9795f877b9de9551694d", "ja3_variant_count": 1, "ja3_variants": [ "4abe7b29775c9795f877b9de9551694d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_eb82186874a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "eb82186874a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-45-23-11-17613-16-51764-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730569, "last_seen": 1789730569, "transport": "t", "ja3_hash": "bb166a837c2b43ac7150c2510f86434f", "ja3_variant_count": 1, "ja3_variants": [ "bb166a837c2b43ac7150c2510f86434f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_f386194d7ef6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "f386194d7ef6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-65037-5-11-17613-45-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789414878, "last_seen": 1789414878, "transport": "t", "ja3_hash": "db1da6fa2d9510d99367c617c395aad4", "ja3_variant_count": 1, "ja3_variants": [ "db1da6fa2d9510d99367c617c395aad4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_0968e040be30", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "0968e040be30", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-27-5-23-13-51764-45-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788776665, "last_seen": 1788776665, "transport": "t", "ja3_hash": "663cebbaf8fd109a63b18ca0176dd495", "ja3_variant_count": 1, "ja3_variants": [ "663cebbaf8fd109a63b18ca0176dd495" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_320e343aa6dc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "320e343aa6dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-45-10-23-27-16-17613-65281-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788491111, "last_seen": 1788491111, "transport": "t", "ja3_hash": "41f86ace2d523bdb64df7098ca0c8185", "ja3_variant_count": 1, "ja3_variants": [ "41f86ace2d523bdb64df7098ca0c8185" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_52a5af5f622d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "52a5af5f622d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-65037-65281-45-10-5-18-16-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789431412, "last_seen": 1789431412, "transport": "t", "ja3_hash": "5cb2a448457cc3fa834848ee664bffcc", "ja3_variant_count": 1, "ja3_variants": [ "5cb2a448457cc3fa834848ee664bffcc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_79cfec709a48", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "79cfec709a48", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-16-17613-65281-23-35-51764-5-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788499356, "last_seen": 1788499356, "transport": "t", "ja3_hash": "97107aa1a48419d04dfa37e7cfa29049", "ja3_variant_count": 1, "ja3_variants": [ "97107aa1a48419d04dfa37e7cfa29049" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_7f120964cd27", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "7f120964cd27", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-13-17613-65281-16-11-45-23-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788891722, "last_seen": 1788891722, "transport": "t", "ja3_hash": "5040d62310aad50ea7f0da0c2bf56b2f", "ja3_variant_count": 1, "ja3_variants": [ "5040d62310aad50ea7f0da0c2bf56b2f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_8934c96212b8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "8934c96212b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-65037-5-23-10-27-35-65281-17613-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789658023, "last_seen": 1789658023, "transport": "t", "ja3_hash": "5cb4ba1db31c1c99c0195b2f91973cb3", "ja3_variant_count": 1, "ja3_variants": [ "5cb4ba1db31c1c99c0195b2f91973cb3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_d70f2e40ee3b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "d70f2e40ee3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-17613-65037-13-45-65281-16-11-18-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789704612, "last_seen": 1789704612, "transport": "t", "ja3_hash": "1a5bda93591bbb7016c42111ef1a7fc6", "ja3_variant_count": 1, "ja3_variants": [ "1a5bda93591bbb7016c42111ef1a7fc6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_f185fa46ae68", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "f185fa46ae68", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51764-5-65037-17613-65281-10-23-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788945094, "last_seen": 1788945094, "transport": "t", "ja3_hash": "19548cc1e29f1cdaeea0ec4dfb2b6a03", "ja3_variant_count": 1, "ja3_variants": [ "19548cc1e29f1cdaeea0ec4dfb2b6a03" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_67a5bdf8c29a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "67a5bdf8c29a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-51764-35-45-27-16-18-65281-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788891368, "last_seen": 1788891368, "transport": "t", "ja3_hash": "bbe9247d7ab1a66669cae8e8508a201b", "ja3_variant_count": 1, "ja3_variants": [ "bbe9247d7ab1a66669cae8e8508a201b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_8423e8b48f42", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "8423e8b48f42", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-45-16-35-13-51764-18-65037-5-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508351, "last_seen": 1788508351, "transport": "t", "ja3_hash": "dcd5ba94e28819e47731427835075004", "ja3_variant_count": 1, "ja3_variants": [ "dcd5ba94e28819e47731427835075004" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_96935d829e54", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "96935d829e54", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51764-5-65037-16-17613-65281-23-18-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391197, "last_seen": 1789391197, "transport": "t", "ja3_hash": "060bbbaeedd78bd5eb8f55257f758b20", "ja3_variant_count": 1, "ja3_variants": [ "060bbbaeedd78bd5eb8f55257f758b20" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_aa634d860130", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "aa634d860130", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-16-17613-23-65037-13-27-35-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788542455, "last_seen": 1788542455, "transport": "t", "ja3_hash": "6dadfe89b5f087c79806361ab22d7bf3", "ja3_variant_count": 1, "ja3_variants": [ "6dadfe89b5f087c79806361ab22d7bf3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_ba231424323b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "ba231424323b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-5-11-18-35-10-27-16-17613-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788442226, "last_seen": 1788442226, "transport": "t", "ja3_hash": "b55da5a9287b60645990a12b46b8df1f", "ja3_variant_count": 1, "ja3_variants": [ "b55da5a9287b60645990a12b46b8df1f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_46542c49e17c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "46542c49e17c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-10-13-17613-23-5-35-11-45-27-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789750666, "last_seen": 1789750666, "transport": "t", "ja3_hash": "9951cb0ac30b6a07e78edbc9601e3ac1", "ja3_variant_count": 1, "ja3_variants": [ "9951cb0ac30b6a07e78edbc9601e3ac1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_a4c022edbcae", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "a4c022edbcae", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-18-11-65281-10-51764-5-35-17613-27-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723899, "last_seen": 1788723899, "transport": "t", "ja3_hash": "6f78a6951af85a37da6ee04e203d75a5", "ja3_variant_count": 1, "ja3_variants": [ "6f78a6951af85a37da6ee04e203d75a5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_cfc5794f8f3d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "cfc5794f8f3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-35-18-23-16-17613-10-51764-5-13-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789728401, "last_seen": 1789728401, "transport": "t", "ja3_hash": "9f5591f1d5c0e3e2b2693a6dc098511e", "ja3_variant_count": 1, "ja3_variants": [ "9f5591f1d5c0e3e2b2693a6dc098511e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1514h2_8daaf6152771_bd367129f6ad", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1514h2", "b": "8daaf6152771", "c": "bd367129f6ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-51764-16-45-17613-65281-35-10-27-5-11-13-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788512327, "last_seen": 1788512327, "transport": "t", "ja3_hash": "ce3a1f75f17c72bfb5cb39f68d4372ae", "ja3_variant_count": 1, "ja3_variants": [ "ce3a1f75f17c72bfb5cb39f68d4372ae" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i2108ht_76e208dd3e22_09f609c8facd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i2108ht", "b": "76e208dd3e22", "c": "09f609c8facd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 21, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,5-10-11-13-35-16-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787475202, "last_seen": 1789221171, "transport": "t", "ja3_hash": "e62a5f4d538cbf169c2af71bec2399b4", "ja3_variant_count": 1, "ja3_variants": [ "e62a5f4d538cbf169c2af71bec2399b4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i4905ht_730fb1b0ac6a_8cd38e60fdc3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i4905ht", "b": "730fb1b0ac6a", "c": "8cd38e60fdc3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 49, "extension_count": 5, "alpn": "ht" } }, "ja3_string": "771,49200-49196-49199-49195-159-158-49202-49198-49201-49197-165-161-164-160-49192-49188-49172-49162-49194-49190-49167-49157-49191-49187-49171-49161-49193-49189-49166-49156-107-105-104-57-55-54-103-63-62-51-49-48-157-156-61-53-60-47-255,11-10-13-15-16,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 32, "first_seen": 1788475176, "last_seen": 1789948572, "transport": "t", "ja3_hash": "872afe5bfa5995245e58609aa23f6a0d", "ja3_variant_count": 1, "ja3_variants": [ "872afe5bfa5995245e58609aa23f6a0d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0307h2_55b375c5d22e_2b813b6b2cb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0307h2", "b": "55b375c5d22e", "c": "2b813b6b2cb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867,0-43-10-51-13-45-16,4588-29-23-30-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789488957, "last_seen": 1789489039, "transport": "t", "ja3_hash": "19d049360355b96a5be9770eedbe3f36", "ja3_variant_count": 1, "ja3_variants": [ "19d049360355b96a5be9770eedbe3f36" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d030900_55b375c5d22e_3fb7e35edb64", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d030900", "b": "55b375c5d22e", "c": "3fb7e35edb64", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867,0-18-65037-5-10-13-50-43-51,29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 14, "first_seen": 1787480193, "last_seen": 1789938032, "transport": "t", "ja3_hash": "02429cee3f7e112df5fbd7b72066c80a", "ja3_variant_count": 1, "ja3_variants": [ "02429cee3f7e112df5fbd7b72066c80a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d030900_55b375c5d22e_dce569508a71", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d030900", "b": "55b375c5d22e", "c": "dce569508a71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865,0-10-35-22-23-13-43-45-51,4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788838597, "last_seen": 1788838597, "transport": "t", "ja3_hash": "6f97bb9ec3a3e42646cad6fa2e5b88b9", "ja3_variant_count": 1, "ja3_variants": [ "6f97bb9ec3a3e42646cad6fa2e5b88b9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d031000_55b375c5d22e_b5f1502c64c6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d031000", "b": "55b375c5d22e", "c": "b5f1502c64c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865,0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 40, "first_seen": 1788710035, "last_seen": 1789515503, "transport": "t", "ja3_hash": "f5c2d6c1503bcf489bc6027b73c55e95", "ja3_variant_count": 2, "ja3_variants": [ "f5c2d6c1503bcf489bc6027b73c55e95", "09f54c71a63b6b1441bd0d025213f201" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d031100_55b375c5d22e_635104d325f0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d031100", "b": "55b375c5d22e", "c": "635104d325f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 28, "first_seen": 1787464628, "last_seen": 1789868667, "transport": "t", "ja3_hash": "bf8552b4338989802acb9315f00dbbe7", "ja3_variant_count": 1, "ja3_variants": [ "bf8552b4338989802acb9315f00dbbe7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d031100_55b375c5d22e_aeb2b64a872a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d031100", "b": "55b375c5d22e", "c": "aeb2b64a872a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865,0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 104, "first_seen": 1788525332, "last_seen": 1789524569, "transport": "t", "ja3_hash": "7c5d0596cedb9c086e8bebef099e73dc", "ja3_variant_count": 5, "ja3_variants": [ "7c5d0596cedb9c086e8bebef099e73dc", "4e2c06ee8efc88ac876ccc99282311df", "55c573e924485d33041ae400987255f3", "3d622dc951bc68a4653b5ae99e6e2dda", "3d279aaddb78527e9210e5d9282bc229" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0312h2_55b375c5d22e_16d5fd281d0e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0312h2", "b": "55b375c5d22e", "c": "16d5fd281d0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 100, "first_seen": 1789064660, "last_seen": 1789137439, "transport": "t", "ja3_hash": "1bcbceb7d6c06f583eeb65246997739f", "ja3_variant_count": 2, "ja3_variants": [ "1bcbceb7d6c06f583eeb65246997739f", "597039baddf9dd436734cebbf9847496" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d040600_f03b13587ee1_827bd6fd5353", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d040600", "b": "f03b13587ee1", "c": "827bd6fd5353", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4868-4869-255,0-10-11-13-43-51,29-23-24-25-30-256-257-4588-4587-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-26-27-28-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787509866, "last_seen": 1789900802, "transport": "t", "ja3_hash": "4727c3a5fbcb61a92bb997698e5a846e", "ja3_variant_count": 1, "ja3_variants": [ "4727c3a5fbcb61a92bb997698e5a846e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d041100_16476d049b0b_73702258a521", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d041100", "b": "16476d049b0b", "c": "73702258a521", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-255,0-11-10-35-5-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 39, "first_seen": 1787509870, "last_seen": 1789900808, "transport": "t", "ja3_hash": "80700cb88113eb45240dab69aadf2826", "ja3_variant_count": 1, "ja3_variants": [ "80700cb88113eb45240dab69aadf2826" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0411h2_16476d049b0b_a78b9a7aa7a1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0411h2", "b": "16476d049b0b", "c": "a78b9a7aa7a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-255,0-11-10-35-16-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 105, "first_seen": 1787509870, "last_seen": 1789900808, "transport": "t", "ja3_hash": "8a90cbcdd6c3024b17337525922f12b9", "ja3_variant_count": 1, "ja3_variants": [ "8a90cbcdd6c3024b17337525922f12b9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d050500_13f69f63e3fe_1a196bf7ea71", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d050500", "b": "13f69f63e3fe", "c": "1a196bf7ea71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 5, "extension_count": 5, "alpn": null } }, "ja3_string": "771,198-199-4865-4868-4869,10-0-13-43-51,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789653766, "last_seen": 1789653766, "transport": "t", "ja3_hash": "fb6f2539f233d8b31618fd0beb7a4805", "ja3_variant_count": 1, "ja3_variants": [ "fb6f2539f233d8b31618fd0beb7a4805" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d050600_13f69f63e3fe_83fe30743d85", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d050600", "b": "13f69f63e3fe", "c": "83fe30743d85", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 5, "extension_count": 6, "alpn": null } }, "ja3_string": "771,198-199-4865-4868-4869,10-0-13-43-51-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 8, "first_seen": 1789653179, "last_seen": 1789654770, "transport": "t", "ja3_hash": "1336e65066ae4b2c24d74c96a29e2b4c", "ja3_variant_count": 1, "ja3_variants": [ "1336e65066ae4b2c24d74c96a29e2b4c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d050600_75d938f10e26_827bd6fd5353", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d050600", "b": "75d938f10e26", "c": "827bd6fd5353", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 5, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4867-4868-4869-255,0-10-11-13-43-51,29-23-24-25-30-256-257-4588-4587-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-26-27-28-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787509862, "last_seen": 1789900803, "transport": "t", "ja3_hash": "1291c5bcb2f6101dc99f62ea2d53d768", "ja3_variant_count": 1, "ja3_variants": [ "1291c5bcb2f6101dc99f62ea2d53d768" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d051000_d55e91d5c3b2_cc96517400c0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d051000", "b": "d55e91d5c3b2", "c": "cc96517400c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 5, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788706835, "last_seen": 1789364198, "transport": "t", "ja3_hash": "624fc9c483a36be55313ea2630717fbc", "ja3_variant_count": 1, "ja3_variants": [ "624fc9c483a36be55313ea2630717fbc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d060600_a150a9413979_827bd6fd5353", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d060600", "b": "a150a9413979", "c": "827bd6fd5353", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4868-4869-4867-255,0-10-11-13-43-51,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-256-257-258-259-260-4588-4587,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 210, "first_seen": 1787509864, "last_seen": 1789900803, "transport": "t", "ja3_hash": "54faf2f91fbbb069efec488ae341918e", "ja3_variant_count": 6, "ja3_variants": [ "54faf2f91fbbb069efec488ae341918e", "bfde521bffcc510f3d5515a743683698", "877398420ef17eb88990074c65f5b91c", "723f132a5f8e4df6d3b3cffc6a0adb8c", "67564387362c3d70f818f02a65dd43c9", "b0a5ff463e446f01d3f968c1d72fe8f3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d060600_a6485224f4b1_83fe30743d85", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d060600", "b": "a6485224f4b1", "c": "83fe30743d85", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 6, "alpn": null } }, "ja3_string": "771,198-199-4865-4867-4868-4869,10-0-13-43-51-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 9, "first_seen": 1789653179, "last_seen": 1789654770, "transport": "t", "ja3_hash": "da26f2c40e1f4c0812b5bd573f347edf", "ja3_variant_count": 1, "ja3_variants": [ "da26f2c40e1f4c0812b5bd573f347edf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d060700_a150a9413979_241b3681de17", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d060700", "b": "a150a9413979", "c": "241b3681de17", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 7, "alpn": null } }, "ja3_string": "771,255-4866-4865-4867-4868-4869,51-11-43-0-50-10-13,29-30-25-24-23-33-32-31,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1787710534, "last_seen": 1789193008, "transport": "t", "ja3_hash": "2f8ab4e846536235e3a043f3c5635ac8", "ja3_variant_count": 4, "ja3_variants": [ "2f8ab4e846536235e3a043f3c5635ac8", "343624f5dcfa001bfe9c82bd02b79c12", "292a23d18e391ecdb06c8dccedd524d2", "a5c511e872d7b937bb510525c4d7c8e8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d061100_a150a9413979_ce3af45f0a37", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d061100", "b": "a150a9413979", "c": "ce3af45f0a37", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4869-4868-255,0-11-10-35-22-23-13-43-45-51-41,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787509880, "last_seen": 1789900818, "transport": "t", "ja3_hash": "8a5045bb4bff4ea43f73711399d0e5a8", "ja3_variant_count": 1, "ja3_variants": [ "8a5045bb4bff4ea43f73711399d0e5a8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d061100_da75d768228b_408777b7afc8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d061100", "b": "da75d768228b", "c": "408777b7afc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-4865-4866,0-11-65281-23-18-5-10-13-50-43-51,4588-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788881625, "last_seen": 1788881625, "transport": "t", "ja3_hash": "5e8ac5c73ac325743464fa03c7d4d809", "ja3_variant_count": 1, "ja3_variants": [ "5e8ac5c73ac325743464fa03c7d4d809" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070500_c2f3549b8eb7_1a196bf7ea71", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070500", "b": "c2f3549b8eb7", "c": "1a196bf7ea71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 10, "first_seen": 1789653175, "last_seen": 1789654767, "transport": "t", "ja3_hash": "befaec56d37047ec064813d7aa625d19", "ja3_variant_count": 3, "ja3_variants": [ "befaec56d37047ec064813d7aa625d19", "d182279e6f41087335aa75c9d114d6b7", "50e04f3c4722ebf608e403c99944152a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070600_c2f3549b8eb7_83fe30743d85", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070600", "b": "c2f3549b8eb7", "c": "83fe30743d85", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-65281,4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 120, "first_seen": 1789653172, "last_seen": 1789654783, "transport": "t", "ja3_hash": "5c06a6e140b4d06398861b4043ed281c", "ja3_variant_count": 8, "ja3_variants": [ "5c06a6e140b4d06398861b4043ed281c", "5a835cb56fd547cb9b2e475447d21645", "a914c792418d079720527c7acd7e09e4", "518dae58aac755998789b2d634d0871a", "188ee2d33a9648c1382ec8bb325897fd", "6ac3f2f3f61c9a013fe62af2a6232da5", "dd50834fa61add78a8c00db7ea3f2925", "9accfbbb7b67c37aca0bef37fe7f8979" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070600_c2f3549b8eb7_aa419bfe26ff", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070600", "b": "c2f3549b8eb7", "c": "aa419bfe26ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 38, "first_seen": 1789653177, "last_seen": 1789654767, "transport": "t", "ja3_hash": "389a54c6aed5cb0c42e5e59e0b5d4aa5", "ja3_variant_count": 1, "ja3_variants": [ "389a54c6aed5cb0c42e5e59e0b5d4aa5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070600_c2f3549b8eb7_b3482a6e6e3b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070600", "b": "c2f3549b8eb7", "c": "b3482a6e6e3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-65281,23-24-25-29-30-31-32-33-41,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false } ], "point_formats": [] }, "observed": { "count": 27, "first_seen": 1789653183, "last_seen": 1789654775, "transport": "t", "ja3_hash": "d668ef29ed3a180c2282c4eb40d7cce8", "ja3_variant_count": 1, "ja3_variants": [ "d668ef29ed3a180c2282c4eb40d7cce8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070700_c2f3549b8eb7_042c22f55c40", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070700", "b": "c2f3549b8eb7", "c": "042c22f55c40", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-50-43-51-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789654767, "last_seen": 1789654768, "transport": "t", "ja3_hash": "c78b462a8ef5805740b412bf4bb51976", "ja3_variant_count": 1, "ja3_variants": [ "c78b462a8ef5805740b412bf4bb51976" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d090900_f91f431d341e_543460421724", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d090900", "b": "f91f431d341e", "c": "543460421724", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 9, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392,13-10-43-5-45-51-0-23-11,4588-24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 43, "first_seen": 1788453337, "last_seen": 1789412579, "transport": "t", "ja3_hash": "a7d53e21f5a4ed26873b063c5bf8ffe3", "ja3_variant_count": 43, "ja3_variants": [ "a7d53e21f5a4ed26873b063c5bf8ffe3", "3cd94d67354f32851d4afd30ca4df490", "445a2cecbbdcf544b7dffa1736921ddd", "9d9e10ae58e244486be2393a5024b32d", "021577f57230895e49a17a2ac161e7e8", "534e1cf9234fa92ea3f8b30127ab30a8", "bb5290198f0dcfab4df7cf33e6701e93", "005825ba770f617b97c4831e752675ba", "daa372fa26eed2660b0e01d22efcc0db", "3ac1a4cf21907a597cb6d0303496d26f", "5a11dd54e1541060b3e9d1b3fd0ba367", "5371428fcb60f94225bf4ab427bfcbe4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d091000_f91f431d341e_978abd8b448c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d091000", "b": "f91f431d341e", "c": "978abd8b448c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 9, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392,5-51-45-13-23-43-11-10-27-0,4588-24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 69, "first_seen": 1789442437, "last_seen": 1789928302, "transport": "t", "ja3_hash": "9ee45504982aa74ea37549e75cff8118", "ja3_variant_count": 69, "ja3_variants": [ "9ee45504982aa74ea37549e75cff8118", "20eed6c8bb69e865e1050e8c86b20986", "fd7d63a421558648e048c334d767cf82", "8ea642899a3adc248fb2154fc7530f06", "b42a99511fb69876a82f129eb682cfb4", "e23204efd255ce484efa2b98ea754ed8", "15af92214ef8d190ea5ce7f17cce0be7", "0e7a4189e795b727bff9c9f26452da9e", "41782ca816b04cab2a074c1a10b83701", "ee63d572f6a33db17b581a9560172b6b", "bbb19dbe1957880e06fa69d3dfe43d99", "412649d6b14f74fd5b58e26a4bd2f87b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d091000_f91f431d341e_f6d7ce0f4a3c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d091000", "b": "f91f431d341e", "c": "f6d7ce0f4a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 9, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392,5-13-23-43-51-10-45-27-0-11,4588-24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1789935709, "last_seen": 1789964604, "transport": "t", "ja3_hash": "19309a3de2bce401caff38e32a2c4158", "ja3_variant_count": 14, "ja3_variants": [ "19309a3de2bce401caff38e32a2c4158", "3d23336b3e653c799efa9e1e35cf42ed", "e41b3b951528801a4e37b9f60c4cc1a7", "40a45a14405b643f7bfd298a26ae75a9", "666e14d880dc3a0bd50442a5ab26dd1a", "ec909eafd1ab9ab09b81881c3af20a40", "1bfe6478fad2f0c87a0bd055aa396582", "868086936065fe59658e1388f2d7e293", "9ed13b69162d70441997d48e636bb05c", "c3f84f80e42f255a4203fa236776dedc", "cc91896f7cc6b966cafd14c31310d9b8", "64a42310a4780445972e436661aa7024" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d101000_61a7ad8aa9b6_815af8d700c8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "815af8d700c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-43-10-5-51-35-23-13-0-11,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789652068, "last_seen": 1789657932, "transport": "t", "ja3_hash": "08d4b80ccbe1ed3b2517d94c5862770a", "ja3_variant_count": 5, "ja3_variants": [ "08d4b80ccbe1ed3b2517d94c5862770a", "690dcf0eff78c40c4c67bfc235041555", "ef18f791c09a7ee259889d68618961ca", "6eb63241f84df2b18084f68770a6e6e2", "1f5f9b42226c3bbbf8965dcf1bb66bb7" ], "user_agents": { "ccfetch/1.0": 5 }, "ua_disagreement": false } }, { "hash": "t13d1011h2_61a7ad8aa9b6_3d90412d0a0b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "3d90412d0a0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-35-13-11-0-43-45-51-23-10-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789041388, "last_seen": 1789041388, "transport": "t", "ja3_hash": "d0ea51e9f6b327ff1804e1f1c1bb49ce", "ja3_variant_count": 1, "ja3_variants": [ "d0ea51e9f6b327ff1804e1f1c1bb49ce" ], "user_agents": { "tphotobot/0.1 (+https://CHANGE-ME.example/tphotobot)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1011ht_61a7ad8aa9b6_723f4692b966", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1011ht", "b": "61a7ad8aa9b6", "c": "723f4692b966", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-13-11-10-5-51-0-45-16-43-41,29-23-24-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1789518118, "last_seen": 1789952614, "transport": "t", "ja3_hash": "bf1b7d7b3cf31b04215c4636e572e500", "ja3_variant_count": 8, "ja3_variants": [ "bf1b7d7b3cf31b04215c4636e572e500", "c80e437692ec3acb548c3a8d350e20fe", "963bed13a1d5b4c732517d9ca472e428", "55d1b72ad7417a000c85a82dd2ef4ad1", "6b89b5958c29e3c37bb1eb2e6e63156c", "989d0178e25f8078b551c27b0b7d70cc", "3ae74eda51a7fb006b030aeb417201cd", "efe3fe951ba072f2bfc220cbef578a65" ], "user_agents": { "Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)": 4 }, "ua_disagreement": false } }, { "hash": "t13d1012ht_61a7ad8aa9b6_3ef862bd26ae", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1012ht", "b": "61a7ad8aa9b6", "c": "3ef862bd26ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-45-11-43-0-27-51-16-10-5-13-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 345, "first_seen": 1789675105, "last_seen": 1789968467, "transport": "t", "ja3_hash": "f2182d24405fee4608049f45caf375bc", "ja3_variant_count": 344, "ja3_variants": [ "f2182d24405fee4608049f45caf375bc", "1686c419356b7dd124ce63735669ebd8", "1478df27d83e3c0a56f3a4a49897a7eb", "9417b3141852b3c31eb423bb96e2dcc5", "d0273638f87a46690f0b708ec9084241", "fd306a2369ee1106fab35d45585d08fd", "621b69f67b7e2816b6551a120504ccb7", "fe454a91b741f42563afd79886938593", "98fb6a673393186282319c2ca0d03816", "cafb579d43eb63bd0380ca8284984adf", "d8d86191806380a57eedc8742286652f", "b30e8763d86cea16d21039db912da3e8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1012ht_61a7ad8aa9b6_b38bd6d0bc9a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1012ht", "b": "61a7ad8aa9b6", "c": "b38bd6d0bc9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-27-43-13-11-10-0-23-35-16-45-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 944, "first_seen": 1789674761, "last_seen": 1789968467, "transport": "t", "ja3_hash": "a0dc5c7b8fcfca17b51b4db2438be5fc", "ja3_variant_count": 938, "ja3_variants": [ "a0dc5c7b8fcfca17b51b4db2438be5fc", "6c845a507691ceb858e44fa92a2edfb6", "2eaad0f2e12bfa2391ae682b14417df8", "f824415b4cd3997bf085b91e08dfd0f9", "71c01d97a1d546a812f1e2dab00425eb", "c00dd02cfb0861afca6a86dbc788a746", "bc150fa9afa66fdd999fc754bd4e5e2b", "88c0480018d481790151de90c565d772", "ee5e5e19b492a82024b8a39cb1342605", "c3d504657ef2a74cd462bea293731316", "530d3b619fa247373cdd522905aa0736", "15e12519ce32e7c7edf985b6161cd9f1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d111300_c5d436628c5c_d0a5066ca47b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d111300", "b": "c5d436628c5c", "c": "d0a5066ca47b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191,65281-0-11-10-35-5-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788897541, "last_seen": 1788897541, "transport": "t", "ja3_hash": "64c862715cd74388f17dbc77b5249d86", "ja3_variant_count": 1, "ja3_variants": [ "64c862715cd74388f17dbc77b5249d86" ], "user_agents": { "Observer/1.0 (+https://obsrvr.net/about; crawler@obsrvr.net)": 2 }, "ua_disagreement": false } }, { "hash": "t13d1115h2_c5d436628c5c_9d2f91cd20f0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1115h2", "b": "c5d436628c5c", "c": "9d2f91cd20f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191,65281-0-11-10-35-5-16-22-23-13-43-45-51-27-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 15, "first_seen": 1789401824, "last_seen": 1789886922, "transport": "t", "ja3_hash": "c4ae0642545df6d0ee7359453e2471c7", "ja3_variant_count": 1, "ja3_variants": [ "c4ae0642545df6d0ee7359453e2471c7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 567 }, "ua_disagreement": false } }, { "hash": "t13d121100_2fc95311a792_408777b7afc8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d121100", "b": "2fc95311a792", "c": "408777b7afc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-49171-49172-47-53-10-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788788793, "last_seen": 1788788793, "transport": "t", "ja3_hash": "73f713fd529a67370b19e19e3168ac2c", "ja3_variant_count": 1, "ja3_variants": [ "73f713fd529a67370b19e19e3168ac2c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1213ht_a538d02d76d5_768ed6726269", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1213ht", "b": "a538d02d76d5", "c": "768ed6726269", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191-255,0-11-10-35-5-16-22-23-13-43-45-51-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2237, "first_seen": 1787940500, "last_seen": 1789962396, "transport": "t", "ja3_hash": "6b085700712ac68dd995a3f0b513f185", "ja3_variant_count": 1, "ja3_variants": [ "6b085700712ac68dd995a3f0b513f185" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 177, "Mozilla/5.0": 2, "Mozilla/5.0 (compatible; DataForSeoBot/1.0; +https://dataforseo.com/dataforseo-bot)": 2229 }, "ua_disagreement": false } }, { "hash": "t13d130900_be732f438736_53d4e768415e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d130900", "b": "be732f438736", "c": "53d4e768415e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49200-49195-49199-157-156-49172-49171-53-47-255,0-11-10-23-13-43-45-51-21,23-24-29,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789727183, "last_seen": 1789727183, "transport": "t", "ja3_hash": "e754f4d9b0b5aca3cc6e4818f88cfa39", "ja3_variant_count": 1, "ja3_variants": [ "e754f4d9b0b5aca3cc6e4818f88cfa39" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1311h2_a44d0ee8b3cc_480c14b18160", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1311h2", "b": "a44d0ee8b3cc", "c": "480c14b18160", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49196-49199-49200-49171-156-157-47-53-10,0-23-65281-10-11-35-16-13-51-45-43,4588-29-23-24-25-65074-25497,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 65074, "name": "65074 (0xfe32)", "known": false }, { "value": 25497, "name": "X25519Kyber768Draft00", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788334621, "last_seen": 1788603219, "transport": "t", "ja3_hash": "9487cf6d722f282c94e174ea24ffe7c0", "ja3_variant_count": 1, "ja3_variants": [ "9487cf6d722f282c94e174ea24ffe7c0" ], "user_agents": { "siteradar/0.1 contact: ops@example.com": 2 }, "ua_disagreement": false } }, { "hash": "t13d1312h2_f57a46bbacb6_4f01dca9c5c2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1312h2", "b": "f57a46bbacb6", "c": "4f01dca9c5c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789751507, "last_seen": 1789751507, "transport": "t", "ja3_hash": "95b6f6d62c2c0f5258859e829e0055f5", "ja3_variant_count": 1, "ja3_variants": [ "95b6f6d62c2c0f5258859e829e0055f5" ], "user_agents": { "Mozilla/5.0 (compatible; WordPressPostChecker/1.0)": 3 }, "ua_disagreement": false } }, { "hash": "t13d1410h2_f98f5dc5c741_ee7d08cce510", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1410h2", "b": "f98f5dc5c741", "c": "ee7d08cce510", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-49171-49172-156-157-47-53-255,0-11-10-35-16-23-13-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789581462, "last_seen": 1789633816, "transport": "t", "ja3_hash": "f1e6885be7c9fe76beed9bc9f54f24f7", "ja3_variant_count": 1, "ja3_variants": [ "f1e6885be7c9fe76beed9bc9f54f24f7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_1bb5de40f69a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "1bb5de40f69a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789882724, "last_seen": 1789882724, "transport": "t", "ja3_hash": "e60fcce209a1d73bd98e5b7477ac311f", "ja3_variant_count": 1, "ja3_variants": [ "e60fcce209a1d73bd98e5b7477ac311f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_391ba1f0e679", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "391ba1f0e679", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-51764-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788499350, "last_seen": 1788499350, "transport": "t", "ja3_hash": "ff148da51a3b03b36797e11f3eee07a2", "ja3_variant_count": 1, "ja3_variants": [ "ff148da51a3b03b36797e11f3eee07a2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_5e21bc867bec", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "5e21bc867bec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-43-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788838539, "last_seen": 1788838539, "transport": "t", "ja3_hash": "d0c2f304e4dfa5aea24dcbfced638da8", "ja3_variant_count": 1, "ja3_variants": [ "d0c2f304e4dfa5aea24dcbfced638da8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_f0c919a2e8f0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "f0c919a2e8f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-43-45-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789963693, "last_seen": 1789963693, "transport": "t", "ja3_hash": "ced77aee1bc1b25a54e4c713c445af73", "ja3_variant_count": 1, "ja3_variants": [ "ced77aee1bc1b25a54e4c713c445af73" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_58b6c6ce6ae2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "58b6c6ce6ae2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-51-0-45-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788678122, "last_seen": 1788678122, "transport": "t", "ja3_hash": "c1018277019fefdc080d998d0e43caa0", "ja3_variant_count": 1, "ja3_variants": [ "c1018277019fefdc080d998d0e43caa0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_688629f82b44", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "688629f82b44", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-43-51-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789463338, "last_seen": 1789463338, "transport": "t", "ja3_hash": "195a6e3073a9456c76ad6861552d4578", "ja3_variant_count": 1, "ja3_variants": [ "195a6e3073a9456c76ad6861552d4578" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_76c7973ea616", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "76c7973ea616", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-0-51-13-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789680990, "last_seen": 1789680990, "transport": "t", "ja3_hash": "e6c1fecdc31e3a94043643c22848b796", "ja3_variant_count": 1, "ja3_variants": [ "e6c1fecdc31e3a94043643c22848b796" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_7a3cf4f1c66e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "7a3cf4f1c66e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-43-17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788891719, "last_seen": 1788891719, "transport": "t", "ja3_hash": "cc528d8f57cec9f565673adc449273f9", "ja3_variant_count": 1, "ja3_variants": [ "cc528d8f57cec9f565673adc449273f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_a9e04bb141e9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "a9e04bb141e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-16-18-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789776186, "last_seen": 1789776186, "transport": "t", "ja3_hash": "70a8475aefe753c03ae6228f5f98ec6b", "ja3_variant_count": 1, "ja3_variants": [ "70a8475aefe753c03ae6228f5f98ec6b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_b8c5baf5bfc8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "b8c5baf5bfc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-17613-43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788530083, "last_seen": 1788530083, "transport": "t", "ja3_hash": "cfce3947af030b91332806b5c6783aad", "ja3_variant_count": 1, "ja3_variants": [ "cfce3947af030b91332806b5c6783aad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_6c17e5da15d3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "6c17e5da15d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-27-51-43-45-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788774715, "last_seen": 1788774715, "transport": "t", "ja3_hash": "893ef1b131b4f6984aab5e2fab7ed74a", "ja3_variant_count": 1, "ja3_variants": [ "893ef1b131b4f6984aab5e2fab7ed74a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_b0ca107e30de", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "b0ca107e30de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-45-51-5-0-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789366309, "last_seen": 1789366309, "transport": "t", "ja3_hash": "8e3d2c48a40644c3701788a354107b52", "ja3_variant_count": 1, "ja3_variants": [ "8e3d2c48a40644c3701788a354107b52" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_ba26d0319553", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "ba26d0319553", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-27-0-45-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789630822, "last_seen": 1789630822, "transport": "t", "ja3_hash": "3bee5a02755f20c8cc515486a4e2524b", "ja3_variant_count": 1, "ja3_variants": [ "3bee5a02755f20c8cc515486a4e2524b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_e05705feb738", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "e05705feb738", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-45-27-51-0-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789566961, "last_seen": 1789566961, "transport": "t", "ja3_hash": "1ada8f5bef1e83492fdc0c69053cccf1", "ja3_variant_count": 1, "ja3_variants": [ "1ada8f5bef1e83492fdc0c69053cccf1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_efc7250c9e21", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "efc7250c9e21", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-23-35-0-43-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015035, "last_seen": 1789015035, "transport": "t", "ja3_hash": "02d103a112d90e613d84db4820896260", "ja3_variant_count": 1, "ja3_variants": [ "02d103a112d90e613d84db4820896260" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_f8af4d62aa55", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "f8af4d62aa55", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-13-0-65281-43-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789476163, "last_seen": 1789476163, "transport": "t", "ja3_hash": "e2904a5b5486b46979294dab6e7dc2d3", "ja3_variant_count": 1, "ja3_variants": [ "e2904a5b5486b46979294dab6e7dc2d3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_c3b091230374", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "c3b091230374", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-43-18-13-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789929111, "last_seen": 1789929111, "transport": "t", "ja3_hash": "2889f3d1b903d420885258a843c4ae12", "ja3_variant_count": 1, "ja3_variants": [ "2889f3d1b903d420885258a843c4ae12" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_13ae44bcdc75", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "13ae44bcdc75", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-0-17613-35-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789015038, "last_seen": 1789015038, "transport": "t", "ja3_hash": "ffeed6dfec4411d08f927d3d246f5fe7", "ja3_variant_count": 1, "ja3_variants": [ "ffeed6dfec4411d08f927d3d246f5fe7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_1f77f064d4ae", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "1f77f064d4ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-23-65281-51-35-43-17613,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788459817, "last_seen": 1788459817, "transport": "t", "ja3_hash": "f04dded14998de1a8e5862c3d618986a", "ja3_variant_count": 1, "ja3_variants": [ "f04dded14998de1a8e5862c3d618986a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_64fc35769d5a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "64fc35769d5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-18-43-5-45-27-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730573, "last_seen": 1789730573, "transport": "t", "ja3_hash": "3a8460dc10000dca9ae3eab1d3012db2", "ja3_variant_count": 1, "ja3_variants": [ "3a8460dc10000dca9ae3eab1d3012db2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_6708b298cf60", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "6708b298cf60", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-43-27-35-23-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789680306, "last_seen": 1789680306, "transport": "t", "ja3_hash": "a6014cf179325009c349fc2cb14703f0", "ja3_variant_count": 1, "ja3_variants": [ "a6014cf179325009c349fc2cb14703f0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_88eda335ef98", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "88eda335ef98", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51764-27-23-43-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789907733, "last_seen": 1789907733, "transport": "t", "ja3_hash": "aca0a5dad6e335a8f149db0543f3ea20", "ja3_variant_count": 1, "ja3_variants": [ "aca0a5dad6e335a8f149db0543f3ea20" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_9c70dff70ad7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "9c70dff70ad7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-18-23-5-45-17613-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789929111, "last_seen": 1789929111, "transport": "t", "ja3_hash": "849d3413e4875e4c573fe01b2dbaf639", "ja3_variant_count": 1, "ja3_variants": [ "849d3413e4875e4c573fe01b2dbaf639" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_c242ac1e87e3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "c242ac1e87e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-11-51-0-10-5-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789543668, "last_seen": 1789543668, "transport": "t", "ja3_hash": "9de629515528bba6be021b318157a6d1", "ja3_variant_count": 1, "ja3_variants": [ "9de629515528bba6be021b318157a6d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_ca647619ac85", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "ca647619ac85", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51764-23-18-43-65037-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789292870, "last_seen": 1789292870, "transport": "t", "ja3_hash": "7a1cd816199187fb9c313d778f4e751a", "ja3_variant_count": 1, "ja3_variants": [ "7a1cd816199187fb9c313d778f4e751a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_ca8957053193", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "ca8957053193", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-43-13-5-0-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789381658, "last_seen": 1789381658, "transport": "t", "ja3_hash": "c5906447b452c43460413947d04e7ff3", "ja3_variant_count": 1, "ja3_variants": [ "c5906447b452c43460413947d04e7ff3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_fa57fbbcd37a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "fa57fbbcd37a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-13-65037-43-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788904025, "last_seen": 1788904025, "transport": "t", "ja3_hash": "33f00025c53884c729e39bda1283440d", "ja3_variant_count": 1, "ja3_variants": [ "33f00025c53884c729e39bda1283440d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_928dd4ca2c01", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "928dd4ca2c01", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-10-35-51764-0-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789552178, "last_seen": 1789552178, "transport": "t", "ja3_hash": "6e1eabfdb44b82e464240c68a50b4cd1", "ja3_variant_count": 1, "ja3_variants": [ "6e1eabfdb44b82e464240c68a50b4cd1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_a83686010035", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "a83686010035", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-0-16-45-65037-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839902, "last_seen": 1788839902, "transport": "t", "ja3_hash": "b1d936460839fc17c4e43ef6e0df3c39", "ja3_variant_count": 1, "ja3_variants": [ "b1d936460839fc17c4e43ef6e0df3c39" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_d3f7b721fcff", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "d3f7b721fcff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-51764-17613-43-16-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730599, "last_seen": 1789730599, "transport": "t", "ja3_hash": "a808455f047d2badc53c9f257f22ebf6", "ja3_variant_count": 1, "ja3_variants": [ "a808455f047d2badc53c9f257f22ebf6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_ee9ac659b15e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "ee9ac659b15e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-10-16-5-0-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788934369, "last_seen": 1788934369, "transport": "t", "ja3_hash": "bac2099d64acdcbbea551e004512908e", "ja3_variant_count": 1, "ja3_variants": [ "bac2099d64acdcbbea551e004512908e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_f1d1ccabec35", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "f1d1ccabec35", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-45-0-13-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788711053, "last_seen": 1788711053, "transport": "t", "ja3_hash": "2c6d3fcb4c1efe555d8176da252b049a", "ja3_variant_count": 1, "ja3_variants": [ "2c6d3fcb4c1efe555d8176da252b049a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_f58d3033c247", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "f58d3033c247", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-43-5-13-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789531348, "last_seen": 1789531348, "transport": "t", "ja3_hash": "47dd8ecca2e83ccc47de1ca2ebab38c6", "ja3_variant_count": 1, "ja3_variants": [ "47dd8ecca2e83ccc47de1ca2ebab38c6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_f9dc5ead649b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "f9dc5ead649b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-43-17613-65281-0-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789358513, "last_seen": 1789358513, "transport": "t", "ja3_hash": "03d5a6ac624c45ffb5750a4248259292", "ja3_variant_count": 1, "ja3_variants": [ "03d5a6ac624c45ffb5750a4248259292" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_0a99ec2bb17c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "0a99ec2bb17c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-18-23-43-13-65037-0-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789583998, "last_seen": 1789583998, "transport": "t", "ja3_hash": "3c149b64ccd00e169ef15490699f70dc", "ja3_variant_count": 1, "ja3_variants": [ "3c149b64ccd00e169ef15490699f70dc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_6cee435b32e2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "6cee435b32e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-11-35-13-23-43-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788836935, "last_seen": 1788836935, "transport": "t", "ja3_hash": "674f2efa77f02f7dad47dacd724e8bba", "ja3_variant_count": 1, "ja3_variants": [ "674f2efa77f02f7dad47dacd724e8bba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_781902cdd3f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "781902cdd3f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-13-43-35-5-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789050374, "last_seen": 1789050374, "transport": "t", "ja3_hash": "2f1219e2d72493a979ae6c8e246bdddd", "ja3_variant_count": 1, "ja3_variants": [ "2f1219e2d72493a979ae6c8e246bdddd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_7ef11ff0d4eb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "7ef11ff0d4eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-51-17613-23-5-65281-0-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789430693, "last_seen": 1789430693, "transport": "t", "ja3_hash": "6a8713b70d9cbeab19045f829ed7f56a", "ja3_variant_count": 1, "ja3_variants": [ "6a8713b70d9cbeab19045f829ed7f56a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_a0132305141e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "a0132305141e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51764-10-0-5-43-13-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788950150, "last_seen": 1788950150, "transport": "t", "ja3_hash": "67882d33b9b1d5952547e9add6df1d6d", "ja3_variant_count": 1, "ja3_variants": [ "67882d33b9b1d5952547e9add6df1d6d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_b2ae65a2d86d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "b2ae65a2d86d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-43-65037-17613-27-18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788892614, "last_seen": 1788892614, "transport": "t", "ja3_hash": "cbd1477981c67bbfff3e5cc4fc71530e", "ja3_variant_count": 1, "ja3_variants": [ "cbd1477981c67bbfff3e5cc4fc71530e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_49dd8ddb6c6e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "49dd8ddb6c6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-17613-51764-13-16-5-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789469872, "last_seen": 1789469872, "transport": "t", "ja3_hash": "c7e7f006d4cb36c47d982cad22c8aca5", "ja3_variant_count": 1, "ja3_variants": [ "c7e7f006d4cb36c47d982cad22c8aca5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_5f115f407b3b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "5f115f407b3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-11-0-27-16-35-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027385, "last_seen": 1789027385, "transport": "t", "ja3_hash": "01012904d6d56767adef338a705f1ad0", "ja3_variant_count": 1, "ja3_variants": [ "01012904d6d56767adef338a705f1ad0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_d3bea339f1d8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "d3bea339f1d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-17613-23-65281-16-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789865335, "last_seen": 1789865335, "transport": "t", "ja3_hash": "a006318e05dc01b24105913572664ad9", "ja3_variant_count": 1, "ja3_variants": [ "a006318e05dc01b24105913572664ad9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_db58677ef8ca", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "db58677ef8ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-43-65281-16-0-23-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789456853, "last_seen": 1789456853, "transport": "t", "ja3_hash": "59dafca99a02f08c7af010d80b673462", "ja3_variant_count": 1, "ja3_variants": [ "59dafca99a02f08c7af010d80b673462" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_1a0c9462b5c3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "1a0c9462b5c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-0-18-35-51764-13-5-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789913182, "last_seen": 1789913182, "transport": "t", "ja3_hash": "2b082689dfe80e8e8d90e7d85e83d324", "ja3_variant_count": 1, "ja3_variants": [ "2b082689dfe80e8e8d90e7d85e83d324" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_2ae3386779b7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "2ae3386779b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-0-51764-5-13-45-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730574, "last_seen": 1789730574, "transport": "t", "ja3_hash": "1bb84dc433c77169e6a5ddc664a1b7ca", "ja3_variant_count": 1, "ja3_variants": [ "1bb84dc433c77169e6a5ddc664a1b7ca" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_435ed3c6afa3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "435ed3c6afa3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-18-23-45-65281-0-13-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789931637, "last_seen": 1789931637, "transport": "t", "ja3_hash": "635a09076052a1b7c23d5aea2952fe80", "ja3_variant_count": 1, "ja3_variants": [ "635a09076052a1b7c23d5aea2952fe80" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_59fb22968731", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "59fb22968731", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-35-65281-43-13-45-23-51-11,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788518819, "last_seen": 1788518822, "transport": "t", "ja3_hash": "a31853a69288a2e0789a958ac88d0b35", "ja3_variant_count": 4, "ja3_variants": [ "a31853a69288a2e0789a958ac88d0b35", "8d34efc93b12554fa97d700fb471c0fa", "79fd3ef8f20c4eb0a929d7b74d3592b9", "44aec5bf4c326a7c81ac103f11e320ff" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_800dd2937db2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "800dd2937db2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-18-65281-10-13-17613-43-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789438951, "last_seen": 1789438951, "transport": "t", "ja3_hash": "a427eacb3f1c98661e8ab835588d3aee", "ja3_variant_count": 1, "ja3_variants": [ "a427eacb3f1c98661e8ab835588d3aee" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_986373b11f57", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "986373b11f57", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-65281-13-0-51764-35-10-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789034182, "last_seen": 1789034182, "transport": "t", "ja3_hash": "1078db92cfba9e1d5d97db2979678cdf", "ja3_variant_count": 1, "ja3_variants": [ "1078db92cfba9e1d5d97db2979678cdf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_ac37cb4332d0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "ac37cb4332d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-43-5-65281-0-23-17613-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788461778, "last_seen": 1788461778, "transport": "t", "ja3_hash": "3bcf512b8b160d6f34e6fe82525c180e", "ja3_variant_count": 1, "ja3_variants": [ "3bcf512b8b160d6f34e6fe82525c180e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_d99eca616f54", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "d99eca616f54", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-5-65281-0-11-10-43-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788912388, "last_seen": 1788912388, "transport": "t", "ja3_hash": "c28f5a39cd25d32094bdbd588adbf390", "ja3_variant_count": 1, "ja3_variants": [ "c28f5a39cd25d32094bdbd588adbf390" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_3ddf928fca99", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "3ddf928fca99", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-0-16-65037-45-5-43-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788948623, "last_seen": 1788948623, "transport": "t", "ja3_hash": "b2f89e652493d082541e6324650b65ea", "ja3_variant_count": 1, "ja3_variants": [ "b2f89e652493d082541e6324650b65ea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_d6f19408ed51", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "d6f19408ed51", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-13-10-18-0-23-17613-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789552186, "last_seen": 1789552186, "transport": "t", "ja3_hash": "f7bc42263b6847e320e68b14a7d1095a", "ja3_variant_count": 1, "ja3_variants": [ "f7bc42263b6847e320e68b14a7d1095a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_163eb9cda1e3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "163eb9cda1e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-35-27-0-5-18-23-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788901909, "last_seen": 1788901909, "transport": "t", "ja3_hash": "d7e424e384dc0acf63f43e8be5092c3c", "ja3_variant_count": 1, "ja3_variants": [ "d7e424e384dc0acf63f43e8be5092c3c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_32b815e58942", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "32b815e58942", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-23-65037-18-0-43-13-17613-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788875895, "last_seen": 1788875895, "transport": "t", "ja3_hash": "54d13db90ac767aa58cba97ef84f757c", "ja3_variant_count": 1, "ja3_variants": [ "54d13db90ac767aa58cba97ef84f757c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_4401f719082f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "4401f719082f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-35-43-23-0-45-10-13-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788836938, "last_seen": 1788836938, "transport": "t", "ja3_hash": "07d1cdf128df734560a3d1aef3ddd4b0", "ja3_variant_count": 1, "ja3_variants": [ "07d1cdf128df734560a3d1aef3ddd4b0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_47d795a8546a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "47d795a8546a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-27-17613-13-65281-35-18-43-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788816029, "last_seen": 1788816029, "transport": "t", "ja3_hash": "75541c1682cbd88f1940c61ec7ee2c12", "ja3_variant_count": 1, "ja3_variants": [ "75541c1682cbd88f1940c61ec7ee2c12" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_4e701523cb0c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "4e701523cb0c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-17613-65281-11-13-5-0-43-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789415566, "last_seen": 1789415566, "transport": "t", "ja3_hash": "4f2c5d5b55a0ff21f9cd1251d27abe2d", "ja3_variant_count": 1, "ja3_variants": [ "4f2c5d5b55a0ff21f9cd1251d27abe2d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_73c4a74ab5cf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "73c4a74ab5cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-23-10-0-65037-51764-27-45-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788873366, "last_seen": 1788873366, "transport": "t", "ja3_hash": "b0cd5d5138cd6030c6d0eaecaad5009f", "ja3_variant_count": 1, "ja3_variants": [ "b0cd5d5138cd6030c6d0eaecaad5009f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_975bda0b22cd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "975bda0b22cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-10-11-43-17613-0-45-35-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789689013, "last_seen": 1789689013, "transport": "t", "ja3_hash": "12e3176bac0139ba50d3c1223b46270c", "ja3_variant_count": 1, "ja3_variants": [ "12e3176bac0139ba50d3c1223b46270c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_b64f7db23026", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "b64f7db23026", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-23-35-0-45-27-43-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789204856, "last_seen": 1789204856, "transport": "t", "ja3_hash": "a588d2fccb2e1826e7b81ea6b0008f9b", "ja3_variant_count": 1, "ja3_variants": [ "a588d2fccb2e1826e7b81ea6b0008f9b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_bfacd96d2833", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "bfacd96d2833", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-65281-35-11-10-23-43-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788668156, "last_seen": 1788668156, "transport": "t", "ja3_hash": "d30524bb7e4f84de969d0d8149c9dd49", "ja3_variant_count": 1, "ja3_variants": [ "d30524bb7e4f84de969d0d8149c9dd49" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_213d5f32bcef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "213d5f32bcef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-13-10-65281-5-18-16-43-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789582330, "last_seen": 1789582330, "transport": "t", "ja3_hash": "d083575c63e3ad0048049ff66deb5f65", "ja3_variant_count": 1, "ja3_variants": [ "d083575c63e3ad0048049ff66deb5f65" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_21a2cd80f436", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "21a2cd80f436", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-65037-11-27-43-16-45-18-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788711051, "last_seen": 1788711051, "transport": "t", "ja3_hash": "2e4ff41f1f6f7731b73e59089324b714", "ja3_variant_count": 1, "ja3_variants": [ "2e4ff41f1f6f7731b73e59089324b714" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_3b1aafaf8d1c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "3b1aafaf8d1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-43-45-0-65037-16-27-23-4832-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789654599, "last_seen": 1789654599, "transport": "t", "ja3_hash": "672ed8fda8d5eabdadeb48e291b42df4", "ja3_variant_count": 1, "ja3_variants": [ "672ed8fda8d5eabdadeb48e291b42df4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_48ee921a22b0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "48ee921a22b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-27-51764-65037-65281-16-23-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789462101, "last_seen": 1789462101, "transport": "t", "ja3_hash": "6c76cf51e1c3cc45e8d2e09074e07d78", "ja3_variant_count": 1, "ja3_variants": [ "6c76cf51e1c3cc45e8d2e09074e07d78" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_4b7221fd724e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "4b7221fd724e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-10-0-43-13-18-27-11-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788813787, "last_seen": 1788813787, "transport": "t", "ja3_hash": "4d5894c5d60ca7e4a5132a2f13f7c27f", "ja3_variant_count": 1, "ja3_variants": [ "4d5894c5d60ca7e4a5132a2f13f7c27f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_836bd2becbed", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "836bd2becbed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,13-0-51764-17613-45-43-5-16-10-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789843148, "last_seen": 1789843148, "transport": "t", "ja3_hash": "57faa88cdb57c164d4283bf581f66bc1", "ja3_variant_count": 1, "ja3_variants": [ "57faa88cdb57c164d4283bf581f66bc1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_9f26c159d45d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "9f26c159d45d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-0-5-65037-23-16-43-18-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789381658, "last_seen": 1789381658, "transport": "t", "ja3_hash": "83ece8647c3a2885c0394c415607b133", "ja3_variant_count": 1, "ja3_variants": [ "83ece8647c3a2885c0394c415607b133" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_c64f1edf7cd4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "c64f1edf7cd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-45-27-43-11-35-23-18-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789766894, "last_seen": 1789766894, "transport": "t", "ja3_hash": "d3306d0ef3168be1c5e526b2161a79be", "ja3_variant_count": 1, "ja3_variants": [ "d3306d0ef3168be1c5e526b2161a79be" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_c9e65406e5c9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "c9e65406e5c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,4832-43-10-45-65281-11-16-17613-0-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789587741, "last_seen": 1789587741, "transport": "t", "ja3_hash": "13e461acf335a118e1d005f195686cbf", "ja3_variant_count": 1, "ja3_variants": [ "13e461acf335a118e1d005f195686cbf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_d7a12cdc9f94", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "d7a12cdc9f94", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-65037-11-17613-43-18-16-5-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788741786, "last_seen": 1788741786, "transport": "t", "ja3_hash": "85722338cd8584e98869067595d8b86f", "ja3_variant_count": 1, "ja3_variants": [ "85722338cd8584e98869067595d8b86f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_e7899880c6d5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "e7899880c6d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-13-16-27-45-18-23-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789456855, "last_seen": 1789456855, "transport": "t", "ja3_hash": "a8f53f1e0be9ecf9dab6f1f079f8d646", "ja3_variant_count": 1, "ja3_variants": [ "a8f53f1e0be9ecf9dab6f1f079f8d646" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_ead6a52b9889", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "ead6a52b9889", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,43-11-10-65281-0-5-16-13-23-45-51,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1788895971, "last_seen": 1789034096, "transport": "t", "ja3_hash": "cc67d4b30aae1317d35ce5bf02dccf0f", "ja3_variant_count": 1, "ja3_variants": [ "cc67d4b30aae1317d35ce5bf02dccf0f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_09219f55faf1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "09219f55faf1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-10-23-17613-51764-11-43-65281-18-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788526341, "last_seen": 1788526341, "transport": "t", "ja3_hash": "846b06c15cafddf8dee8cebb24acb14e", "ja3_variant_count": 1, "ja3_variants": [ "846b06c15cafddf8dee8cebb24acb14e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_341e8f247611", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "341e8f247611", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-27-23-17613-65281-0-45-10-35-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789253282, "last_seen": 1789253282, "transport": "t", "ja3_hash": "3a7dd59f30b6c26dfdfabe9e71748d76", "ja3_variant_count": 1, "ja3_variants": [ "3a7dd59f30b6c26dfdfabe9e71748d76" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_c6043fc63584", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "c6043fc63584", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-51764-17613-65281-18-43-23-5-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789672089, "last_seen": 1789672089, "transport": "t", "ja3_hash": "3533f7eaa61569045dcccec108cd7375", "ja3_variant_count": 1, "ja3_variants": [ "3533f7eaa61569045dcccec108cd7375" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_cc65ec8652e1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "cc65ec8652e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-18-5-51764-23-0-65037-43-35-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789744526, "last_seen": 1789744526, "transport": "t", "ja3_hash": "9848b1e45e053fb97525a44bc4e2fa4a", "ja3_variant_count": 1, "ja3_variants": [ "9848b1e45e053fb97525a44bc4e2fa4a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_30bdf8b60e28", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "30bdf8b60e28", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-17613-27-23-45-16-5-13-43-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789720579, "last_seen": 1789720579, "transport": "t", "ja3_hash": "9ec98de40de8a7c25d6d077a9b5e2e47", "ja3_variant_count": 1, "ja3_variants": [ "9ec98de40de8a7c25d6d077a9b5e2e47" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_3bcaeea63215", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "3bcaeea63215", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-16-11-17613-0-51764-13-45-18-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789912451, "last_seen": 1789912451, "transport": "t", "ja3_hash": "bab2aae0e79bfb65a3fdcaae5deb0c1c", "ja3_variant_count": 1, "ja3_variants": [ "bab2aae0e79bfb65a3fdcaae5deb0c1c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_4ae5a7857b3f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "4ae5a7857b3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-65037-35-0-65281-43-23-45-17613-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789776189, "last_seen": 1789776189, "transport": "t", "ja3_hash": "e3ab72b92e7844d18fa75aa603406ed2", "ja3_variant_count": 1, "ja3_variants": [ "e3ab72b92e7844d18fa75aa603406ed2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_4f7a18387677", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "4f7a18387677", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-13-5-23-10-11-45-65281-17613-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789523581, "last_seen": 1789523581, "transport": "t", "ja3_hash": "c575c33b1cb13534ec51ff48e17a2441", "ja3_variant_count": 1, "ja3_variants": [ "c575c33b1cb13534ec51ff48e17a2441" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_5a415f903d87", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "5a415f903d87", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-35-5-65281-16-45-0-27-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788894967, "last_seen": 1788894967, "transport": "t", "ja3_hash": "226a0e0249487dfbcbf177e5b91a224d", "ja3_variant_count": 1, "ja3_variants": [ "226a0e0249487dfbcbf177e5b91a224d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_69246b9177b2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "69246b9177b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-65281-5-0-35-11-27-43-65037-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789578770, "last_seen": 1789578770, "transport": "t", "ja3_hash": "aabd02d0ba07072bc621068a5ff6995e", "ja3_variant_count": 1, "ja3_variants": [ "aabd02d0ba07072bc621068a5ff6995e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_6d26050cdaea", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "6d26050cdaea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-65281-65037-43-23-10-5-18-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788457615, "last_seen": 1788457615, "transport": "t", "ja3_hash": "d867db732c96afef2e5fc49664db4e25", "ja3_variant_count": 1, "ja3_variants": [ "d867db732c96afef2e5fc49664db4e25" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_8440df823685", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "8440df823685", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-16-0-23-51764-17613-43-35-5-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789034267, "last_seen": 1789034267, "transport": "t", "ja3_hash": "ab4a6d89ed01f566cbb539c9b0557690", "ja3_variant_count": 1, "ja3_variants": [ "ab4a6d89ed01f566cbb539c9b0557690" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_aee53cadf675", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "aee53cadf675", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-0-43-10-18-65281-16-51764-17613-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788647901, "last_seen": 1788647901, "transport": "t", "ja3_hash": "3b84b1c619785eb3c2ca4fe25ad93f02", "ja3_variant_count": 1, "ja3_variants": [ "3b84b1c619785eb3c2ca4fe25ad93f02" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_bd45082d1033", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "bd45082d1033", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-45-11-5-16-65281-23-0-17513-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789124468, "last_seen": 1789124468, "transport": "t", "ja3_hash": "0541041878c1ef4201950d4df1232ecf", "ja3_variant_count": 1, "ja3_variants": [ "0541041878c1ef4201950d4df1232ecf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_c01db1d521db", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "c01db1d521db", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-0-27-65037-43-16-23-13-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788678205, "last_seen": 1788678205, "transport": "t", "ja3_hash": "e11c8e619e5d68cb5f6c0d5c9bb3a02d", "ja3_variant_count": 1, "ja3_variants": [ "e11c8e619e5d68cb5f6c0d5c9bb3a02d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f25f363ac0af", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f25f363ac0af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-43-17613-65037-18-13-0-10-23-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789565933, "last_seen": 1789565933, "transport": "t", "ja3_hash": "28008d46ad580c8bed193a09eb979257", "ja3_variant_count": 1, "ja3_variants": [ "28008d46ad580c8bed193a09eb979257" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f66a660c0717", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f66a660c0717", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-43-65281-16-23-17613-65037-0-27-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788469386, "last_seen": 1788469386, "transport": "t", "ja3_hash": "25131338264305c8b599e10b601d882a", "ja3_variant_count": 1, "ja3_variants": [ "25131338264305c8b599e10b601d882a" ], "user_agents": { "slack/26.09.10.0.90016132 (samsung SM-S931U1; Android 16; store com.android.vending)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512ht_8daaf6152771_f0ea2a6d8ae1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512ht", "b": "8daaf6152771", "c": "f0ea2a6d8ae1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-16-0-43-10-11-23-65281-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788820160, "last_seen": 1788820160, "transport": "t", "ja3_hash": "b0318a0a0007fb1d761fa6b6c82ec803", "ja3_variant_count": 1, "ja3_variants": [ "b0318a0a0007fb1d761fa6b6c82ec803" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_01328193b9a6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "01328193b9a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51764-43-13-17613-10-45-65037-35-27-0-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789595477, "last_seen": 1789595477, "transport": "t", "ja3_hash": "596fc4530ace7494bed8de035a45f82c", "ja3_variant_count": 1, "ja3_variants": [ "596fc4530ace7494bed8de035a45f82c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_0a4375ee5e06", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "0a4375ee5e06", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-11-45-0-17613-65037-4832-13-65281-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788625358, "last_seen": 1788625358, "transport": "t", "ja3_hash": "34d19e71e8fb9a2cffc80c0025a528c1", "ja3_variant_count": 1, "ja3_variants": [ "34d19e71e8fb9a2cffc80c0025a528c1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_0d655e8d227e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "0d655e8d227e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-35-13-45-5-17613-11-43-65037-18-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788881851, "last_seen": 1788881851, "transport": "t", "ja3_hash": "8d42716b81b3250c39cc336690021ad8", "ja3_variant_count": 1, "ja3_variants": [ "8d42716b81b3250c39cc336690021ad8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_62849d7b598e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "62849d7b598e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-51764-17613-5-65037-35-10-45-65281-13-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788867967, "last_seen": 1788867967, "transport": "t", "ja3_hash": "a1bf27e296beda7deccf9484ef71090a", "ja3_variant_count": 1, "ja3_variants": [ "a1bf27e296beda7deccf9484ef71090a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_8bb3bd8e047d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "8bb3bd8e047d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-65037-11-45-17613-0-18-51764-23-5-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789587740, "last_seen": 1789587740, "transport": "t", "ja3_hash": "b64e9e4b9a08632f96478d814ecc541d", "ja3_variant_count": 1, "ja3_variants": [ "b64e9e4b9a08632f96478d814ecc541d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_0427074fac13", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "0427074fac13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-23-11-18-5-17613-65281-0-10-35-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788455446, "last_seen": 1788455446, "transport": "t", "ja3_hash": "4b23e1686d9093a87072e36f3c668185", "ja3_variant_count": 1, "ja3_variants": [ "4b23e1686d9093a87072e36f3c668185" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_068cde9bf35a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "068cde9bf35a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-65281-65037-13-11-23-5-35-43-16-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788934418, "last_seen": 1788934418, "transport": "t", "ja3_hash": "e4ab10c0cd4d9cbf96a6d5085c56ec8b", "ja3_variant_count": 1, "ja3_variants": [ "e4ab10c0cd4d9cbf96a6d5085c56ec8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_0a5575733548", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "0a5575733548", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-27-51764-35-65281-65037-17613-45-5-43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788835369, "last_seen": 1788835369, "transport": "t", "ja3_hash": "57fda7124aa8e0e34d3d6978cf27704c", "ja3_variant_count": 1, "ja3_variants": [ "57fda7124aa8e0e34d3d6978cf27704c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_10d1ef184d7a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "10d1ef184d7a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-10-65281-23-27-13-11-35-45-43-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789280484, "last_seen": 1789280484, "transport": "t", "ja3_hash": "5328db301f9f6b4da0cb0242d7a31508", "ja3_variant_count": 1, "ja3_variants": [ "5328db301f9f6b4da0cb0242d7a31508" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_21993be0489e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "21993be0489e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-10-35-43-17613-16-23-5-0-18-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788560345, "last_seen": 1788560345, "transport": "t", "ja3_hash": "cc880a2e9a83dc4b4e2296027d045608", "ja3_variant_count": 1, "ja3_variants": [ "cc880a2e9a83dc4b4e2296027d045608" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_2230ef5936ce", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "2230ef5936ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-23-51764-5-43-27-4832-65037-0-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789701013, "last_seen": 1789701013, "transport": "t", "ja3_hash": "aafc813c68e5ca87b7e3631da99eba84", "ja3_variant_count": 1, "ja3_variants": [ "aafc813c68e5ca87b7e3631da99eba84" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_2ad79bace647", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "2ad79bace647", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-45-5-51764-35-43-0-16-10-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789750000, "last_seen": 1789750000, "transport": "t", "ja3_hash": "c6c1e14821d4c3ddb107acb309de19b5", "ja3_variant_count": 1, "ja3_variants": [ "c6c1e14821d4c3ddb107acb309de19b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_2ffb8507abbc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "2ffb8507abbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-35-43-16-18-65281-17613-0-13-11-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789869199, "last_seen": 1789869199, "transport": "t", "ja3_hash": "df6eeb37aa341970518ccdd977e67550", "ja3_variant_count": 1, "ja3_variants": [ "df6eeb37aa341970518ccdd977e67550" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_31b45bfc656d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "31b45bfc656d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-0-11-45-65281-43-10-18-5-13-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789004730, "last_seen": 1789004730, "transport": "t", "ja3_hash": "3c5face0595dd3348bd82c5d9ee72073", "ja3_variant_count": 1, "ja3_variants": [ "3c5face0595dd3348bd82c5d9ee72073" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_3fc315e4bc1c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "3fc315e4bc1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-13-0-43-10-65037-65281-11-5-16-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789658160, "last_seen": 1789658160, "transport": "t", "ja3_hash": "e6d607261b638ff030f66502e7b0535c", "ja3_variant_count": 1, "ja3_variants": [ "e6d607261b638ff030f66502e7b0535c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_721588076027", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "721588076027", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-43-65037-13-11-18-16-27-0-45-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789792142, "last_seen": 1789792142, "transport": "t", "ja3_hash": "da9637aec25962882eb23be42e3e73ca", "ja3_variant_count": 1, "ja3_variants": [ "da9637aec25962882eb23be42e3e73ca" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_9420bc7b8960", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "9420bc7b8960", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-0-18-5-65037-13-65281-35-10-43-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789122525, "last_seen": 1789122525, "transport": "t", "ja3_hash": "c02dde219a52f2a9750b1da451342147", "ja3_variant_count": 1, "ja3_variants": [ "c02dde219a52f2a9750b1da451342147" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_94e6b60455fb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "94e6b60455fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-0-35-27-18-5-43-16-45-17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789901951, "last_seen": 1789901951, "transport": "t", "ja3_hash": "1e4a5683f46b5a874ea099b6a07fb18c", "ja3_variant_count": 1, "ja3_variants": [ "1e4a5683f46b5a874ea099b6a07fb18c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_a3828233643d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "a3828233643d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51764-43-11-17613-10-65281-35-16-45-0-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788824575, "last_seen": 1788824575, "transport": "t", "ja3_hash": "1837ee8a1955490e997c449e5b0b2010", "ja3_variant_count": 1, "ja3_variants": [ "1837ee8a1955490e997c449e5b0b2010" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_a48629524374", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "a48629524374", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-10-27-5-65037-35-17613-43-0-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788630792, "last_seen": 1788630792, "transport": "t", "ja3_hash": "c2dfe202f4933fac383b8e05ccfb18e2", "ja3_variant_count": 1, "ja3_variants": [ "c2dfe202f4933fac383b8e05ccfb18e2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_abf3d86cf300", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "abf3d86cf300", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-17613-18-45-43-10-23-65037-0-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788533130, "last_seen": 1788533130, "transport": "t", "ja3_hash": "308afd6ad18e2466396f30400fb72b24", "ja3_variant_count": 1, "ja3_variants": [ "308afd6ad18e2466396f30400fb72b24" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_c4af7d3108f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "c4af7d3108f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-16-65281-65037-10-18-11-45-27-43-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469869, "last_seen": 1789469869, "transport": "t", "ja3_hash": "e2dccba04f0ba71ac404477d3cd5128f", "ja3_variant_count": 1, "ja3_variants": [ "e2dccba04f0ba71ac404477d3cd5128f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_cd3755d40a5b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "cd3755d40a5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-23-51764-65281-18-13-16-35-27-43-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789820712, "last_seen": 1789820712, "transport": "t", "ja3_hash": "fe3a88749a0a148d5eb3e03f1b710a90", "ja3_variant_count": 1, "ja3_variants": [ "fe3a88749a0a148d5eb3e03f1b710a90" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_e99adb098657", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "e99adb098657", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-45-27-65281-0-17613-35-16-5-13-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788911291, "last_seen": 1788911291, "transport": "t", "ja3_hash": "e22e04854306777ac0cf677688ce6982", "ja3_variant_count": 1, "ja3_variants": [ "e22e04854306777ac0cf677688ce6982" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513ht_8daaf6152771_61f45fc2c1c9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513ht", "b": "8daaf6152771", "c": "61f45fc2c1c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-43-16-45-18-0-27-10-5-11-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789878641, "last_seen": 1789878641, "transport": "t", "ja3_hash": "1aca846d7998d8835b96a3473de8ad66", "ja3_variant_count": 1, "ja3_variants": [ "1aca846d7998d8835b96a3473de8ad66" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513ht_8daaf6152771_b20fa589102b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513ht", "b": "8daaf6152771", "c": "b20fa589102b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-45-13-0-27-5-65037-16-11-10-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788847357, "last_seen": 1788847357, "transport": "t", "ja3_hash": "d84254abf5bf33525eab12fcab4251da", "ja3_variant_count": 1, "ja3_variants": [ "d84254abf5bf33525eab12fcab4251da" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513ht_8daaf6152771_c11b6b55509d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513ht", "b": "8daaf6152771", "c": "c11b6b55509d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-13-27-11-16-35-43-0-45-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789149469, "last_seen": 1789149469, "transport": "t", "ja3_hash": "640ac0731365d3cf1783cc9f6b00afb9", "ja3_variant_count": 1, "ja3_variants": [ "640ac0731365d3cf1783cc9f6b00afb9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513ht_8daaf6152771_cb4983541e2c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513ht", "b": "8daaf6152771", "c": "cb4983541e2c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-35-11-0-43-65037-27-45-16-18-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789878557, "last_seen": 1789878557, "transport": "t", "ja3_hash": "d6f52552bcb1981063447ee042bc5b41", "ja3_variant_count": 1, "ja3_variants": [ "d6f52552bcb1981063447ee042bc5b41" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_084528d10652", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "084528d10652", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-11-18-10-43-0-65281-23-13-17613-27-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789751588, "last_seen": 1789751588, "transport": "t", "ja3_hash": "3afa6ab82aa840c41d80429ac9415682", "ja3_variant_count": 1, "ja3_variants": [ "3afa6ab82aa840c41d80429ac9415682" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_149dc003db50", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "149dc003db50", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-35-27-45-23-65281-65037-0-5-13-43-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789056837, "last_seen": 1789056837, "transport": "t", "ja3_hash": "04e3bb72e884aa5ee8fc6763bd7ff147", "ja3_variant_count": 1, "ja3_variants": [ "04e3bb72e884aa5ee8fc6763bd7ff147" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_b9099a179302", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "b9099a179302", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-45-43-65281-5-13-0-11-17613-10-65037-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788649468, "last_seen": 1788649468, "transport": "t", "ja3_hash": "077759765b50bfb901b2fdc0740ffff4", "ja3_variant_count": 1, "ja3_variants": [ "077759765b50bfb901b2fdc0740ffff4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_bcc0eb56b5e7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "bcc0eb56b5e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-10-5-17613-35-23-65037-0-43-51764-45-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789657837, "last_seen": 1789657837, "transport": "t", "ja3_hash": "c6eef84c1cee6b51866de8d52863221e", "ja3_variant_count": 1, "ja3_variants": [ "c6eef84c1cee6b51866de8d52863221e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_de3031f27d8b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "de3031f27d8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-17613-35-65281-23-13-18-5-27-0-51764-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789366311, "last_seen": 1789366311, "transport": "t", "ja3_hash": "eca964132f24206543519b5390f9df19", "ja3_variant_count": 1, "ja3_variants": [ "eca964132f24206543519b5390f9df19" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_0d29295bbda6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "0d29295bbda6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-13-51764-23-45-10-35-65281-17613-18-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788911293, "last_seen": 1788911293, "transport": "t", "ja3_hash": "4ee5b76290e2390917c76dcf1b4288c4", "ja3_variant_count": 1, "ja3_variants": [ "4ee5b76290e2390917c76dcf1b4288c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_13faa61246a3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "13faa61246a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-0-11-45-23-43-13-17613-65281-16-10-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789963693, "last_seen": 1789963693, "transport": "t", "ja3_hash": "8049ad0433e00b6850698d355f5c66a4", "ja3_variant_count": 1, "ja3_variants": [ "8049ad0433e00b6850698d355f5c66a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_149bbda496cb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "149bbda496cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-65037-43-5-35-17613-65281-45-13-0-23-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789736897, "last_seen": 1789736897, "transport": "t", "ja3_hash": "c5953ea38d1f5c641f4c56838fba480c", "ja3_variant_count": 1, "ja3_variants": [ "c5953ea38d1f5c641f4c56838fba480c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_1de850e75304", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "1de850e75304", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-51764-5-27-65281-11-43-35-0-10-45-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789923854, "last_seen": 1789923854, "transport": "t", "ja3_hash": "6dbe7b378725a8bf0a667db8e8f05639", "ja3_variant_count": 1, "ja3_variants": [ "6dbe7b378725a8bf0a667db8e8f05639" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_215ce841d4c9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "215ce841d4c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-0-65037-18-23-5-11-16-27-43-10-17513-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788899955, "last_seen": 1788899955, "transport": "t", "ja3_hash": "3026c2dd11a37c046e24dad99e2fb7ef", "ja3_variant_count": 1, "ja3_variants": [ "3026c2dd11a37c046e24dad99e2fb7ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_23ba5db65186", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "23ba5db65186", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-17613-18-16-0-5-51764-10-11-65037-65281-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789749894, "last_seen": 1789749894, "transport": "t", "ja3_hash": "7ab486c49aa7173cfeb452d6fd194f24", "ja3_variant_count": 1, "ja3_variants": [ "7ab486c49aa7173cfeb452d6fd194f24" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_35f54e0b1a82", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "35f54e0b1a82", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-35-13-51764-65281-27-43-23-11-16-18-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789577843, "last_seen": 1789577843, "transport": "t", "ja3_hash": "a10d4d2cd9b3f9bd4d16bccbe0185de2", "ja3_variant_count": 1, "ja3_variants": [ "a10d4d2cd9b3f9bd4d16bccbe0185de2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_4f3cc336e3ee", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "4f3cc336e3ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-10-17613-45-43-5-16-23-18-0-11-65281-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789710912, "last_seen": 1789710912, "transport": "t", "ja3_hash": "8d18d7a7240e7fa6fb702b7e39ffd395", "ja3_variant_count": 1, "ja3_variants": [ "8d18d7a7240e7fa6fb702b7e39ffd395" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_5156df582fb1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "5156df582fb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-43-13-18-35-11-23-0-16-5-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789297581, "last_seen": 1789297581, "transport": "t", "ja3_hash": "6b92dc94eea5bdf62de88bace098a73d", "ja3_variant_count": 1, "ja3_variants": [ "6b92dc94eea5bdf62de88bace098a73d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_62a27464bde7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "62a27464bde7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-23-27-65037-35-10-11-18-45-43-16-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789766894, "last_seen": 1789766894, "transport": "t", "ja3_hash": "fdd2257e95dab08a25cb7aca1fb160ac", "ja3_variant_count": 1, "ja3_variants": [ "fdd2257e95dab08a25cb7aca1fb160ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_64e6dc6d1f26", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "64e6dc6d1f26", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-17613-0-10-65281-43-35-27-65037-18-5-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789486362, "last_seen": 1789486362, "transport": "t", "ja3_hash": "f0299518db3dbd016b487e5b86fce5a9", "ja3_variant_count": 1, "ja3_variants": [ "f0299518db3dbd016b487e5b86fce5a9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_71a288ae58df", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "71a288ae58df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-4832-0-27-23-16-65037-11-35-43-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789654595, "last_seen": 1789654595, "transport": "t", "ja3_hash": "466a3b91ab87e59630138c6e862b59d1", "ja3_variant_count": 1, "ja3_variants": [ "466a3b91ab87e59630138c6e862b59d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_7f1550c5568a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "7f1550c5568a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-43-5-35-0-13-23-65281-16-10-17613-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789523577, "last_seen": 1789523577, "transport": "t", "ja3_hash": "5ce3bfe5102249d1a66a56016015a410", "ja3_variant_count": 1, "ja3_variants": [ "5ce3bfe5102249d1a66a56016015a410" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_810a15a332c1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "810a15a332c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-18-10-27-16-45-43-13-23-0-65281-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789418198, "last_seen": 1789418198, "transport": "t", "ja3_hash": "ee269934ec327b01fc2e584dd12451a5", "ja3_variant_count": 1, "ja3_variants": [ "ee269934ec327b01fc2e584dd12451a5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_836cd95ea05e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "836cd95ea05e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-11-13-27-51764-23-35-45-0-65281-16-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788967490, "last_seen": 1788967490, "transport": "t", "ja3_hash": "f3cdc3295e35a8c7067194cc4d7cb337", "ja3_variant_count": 1, "ja3_variants": [ "f3cdc3295e35a8c7067194cc4d7cb337" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_8468d7ade12c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "8468d7ade12c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-10-0-65037-13-65281-11-5-27-23-17613-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789517704, "last_seen": 1789517704, "transport": "t", "ja3_hash": "0e42f89aeef3c425e04f1b5f48fb7914", "ja3_variant_count": 1, "ja3_variants": [ "0e42f89aeef3c425e04f1b5f48fb7914" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_865757d90d4e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "865757d90d4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-17613-27-5-18-43-35-16-65281-13-45-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789200144, "last_seen": 1789200144, "transport": "t", "ja3_hash": "367b6ed4384ed176420d71e313204930", "ja3_variant_count": 1, "ja3_variants": [ "367b6ed4384ed176420d71e313204930" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_87766c1a4490", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "87766c1a4490", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-51764-0-27-23-17613-65037-35-10-11-65281-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789538326, "last_seen": 1789538326, "transport": "t", "ja3_hash": "3cdb13e81fce4f800e2c8c78d67644e7", "ja3_variant_count": 1, "ja3_variants": [ "3cdb13e81fce4f800e2c8c78d67644e7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_8bafa0803767", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "8bafa0803767", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-27-65037-5-35-16-10-0-13-51764-65281-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789923855, "last_seen": 1789923855, "transport": "t", "ja3_hash": "c686f31454b6e4fb74e61cb115b15099", "ja3_variant_count": 1, "ja3_variants": [ "c686f31454b6e4fb74e61cb115b15099" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_8be788a27918", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "8be788a27918", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-23-13-18-65037-0-17613-65281-35-10-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789168905, "last_seen": 1789168905, "transport": "t", "ja3_hash": "68f4a97112f2c9232a3d93d939cf94d6", "ja3_variant_count": 1, "ja3_variants": [ "68f4a97112f2c9232a3d93d939cf94d6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_8f1a84465d36", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "8f1a84465d36", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-5-10-0-27-43-51764-45-23-16-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788891165, "last_seen": 1788891165, "transport": "t", "ja3_hash": "4a50c8d2570a53ff7318f34f0e29a3f2", "ja3_variant_count": 1, "ja3_variants": [ "4a50c8d2570a53ff7318f34f0e29a3f2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_99e3259a919e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "99e3259a919e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-0-13-18-45-16-27-5-23-51764-43-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789552182, "last_seen": 1789552182, "transport": "t", "ja3_hash": "88c81a0f108fad1796100a016ca0086a", "ja3_variant_count": 1, "ja3_variants": [ "88c81a0f108fad1796100a016ca0086a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_9f508d7910ef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "9f508d7910ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-43-18-11-13-10-45-17613-51764-23-65037-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788858762, "last_seen": 1788858762, "transport": "t", "ja3_hash": "2a198cd172f6d487986fdfbc80a32e3b", "ja3_variant_count": 1, "ja3_variants": [ "2a198cd172f6d487986fdfbc80a32e3b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_afe36b7eeadd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "afe36b7eeadd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-65281-0-17613-35-43-51764-5-23-10-13-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788988736, "last_seen": 1788988736, "transport": "t", "ja3_hash": "47732385445f42764b8bc791c3648151", "ja3_variant_count": 1, "ja3_variants": [ "47732385445f42764b8bc791c3648151" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_bffd00849e05", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "bffd00849e05", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-5-35-0-43-18-13-11-16-23-17613-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789024343, "last_seen": 1789024343, "transport": "t", "ja3_hash": "b6be7388031f375de36e72c11e26cb92", "ja3_variant_count": 1, "ja3_variants": [ "b6be7388031f375de36e72c11e26cb92" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_cb1e12ca09f6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "cb1e12ca09f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-65037-13-27-18-0-16-23-11-35-5-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789336547, "last_seen": 1789336547, "transport": "t", "ja3_hash": "773b2dc526691a413a6c63eac8d051a4", "ja3_variant_count": 1, "ja3_variants": [ "773b2dc526691a413a6c63eac8d051a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d0956fc89721", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d0956fc89721", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-17613-5-18-45-65281-16-65037-43-11-0-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789218780, "last_seen": 1789218780, "transport": "t", "ja3_hash": "e0ffa99676a0f1ae22c7a1852baeb06b", "ja3_variant_count": 1, "ja3_variants": [ "e0ffa99676a0f1ae22c7a1852baeb06b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d1ba522d23d4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d1ba522d23d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-43-23-45-17613-16-27-65037-51764-10-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788894767, "last_seen": 1788894767, "transport": "t", "ja3_hash": "09546c084fbb1b3958e9701335ed6cdf", "ja3_variant_count": 1, "ja3_variants": [ "09546c084fbb1b3958e9701335ed6cdf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d34fad65fa15", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d34fad65fa15", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-16-11-5-13-45-18-35-17613-10-65037-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789059656, "last_seen": 1789059656, "transport": "t", "ja3_hash": "62c67e239b1c1b5a39f024dfa09f1b07", "ja3_variant_count": 1, "ja3_variants": [ "62c67e239b1c1b5a39f024dfa09f1b07" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_de538a954cf5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "de538a954cf5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-43-35-51764-5-13-65037-16-0-27-65281-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788931111, "last_seen": 1788931111, "transport": "t", "ja3_hash": "fee47ee8a6acf655e9d9f89ad64f538f", "ja3_variant_count": 1, "ja3_variants": [ "fee47ee8a6acf655e9d9f89ad64f538f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_deb1cd3d2020", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "deb1cd3d2020", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-10-13-0-65281-18-45-27-16-17613-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789866427, "last_seen": 1789866427, "transport": "t", "ja3_hash": "443b787e83773e178770e2a4f08fd565", "ja3_variant_count": 1, "ja3_variants": [ "443b787e83773e178770e2a4f08fd565" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_ed8858f9260b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "ed8858f9260b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-17613-35-10-13-0-43-16-11-65281-23-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789667832, "last_seen": 1789667832, "transport": "t", "ja3_hash": "3ef960c2733464295667a6a0deed1d66", "ja3_variant_count": 1, "ja3_variants": [ "3ef960c2733464295667a6a0deed1d66" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_fea9d9e3b931", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "fea9d9e3b931", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-10-0-23-51764-5-17613-11-65037-43-16-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789654461, "last_seen": 1789654461, "transport": "t", "ja3_hash": "99a47041d2bb91c8806b4787be1fe4d8", "ja3_variant_count": 1, "ja3_variants": [ "99a47041d2bb91c8806b4787be1fe4d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_ff51abce5dce", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "ff51abce5dce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-11-17613-35-23-27-51764-0-10-43-16-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788873167, "last_seen": 1788873167, "transport": "t", "ja3_hash": "b234ee5c834c442ab2f2102109901d7a", "ja3_variant_count": 1, "ja3_variants": [ "b234ee5c834c442ab2f2102109901d7a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_09c52da4402a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "09c52da4402a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-27-65037-51764-18-17613-65281-0-35-43-5-23-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469414, "last_seen": 1789469414, "transport": "t", "ja3_hash": "a0a4cfc778967a1b0a541f71aad34632", "ja3_variant_count": 1, "ja3_variants": [ "a0a4cfc778967a1b0a541f71aad34632" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_3ea848142ccb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "3ea848142ccb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-5-65281-10-43-35-11-23-13-18-65037-27-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789361014, "last_seen": 1789361014, "transport": "t", "ja3_hash": "5165922019718c0cf8fa84f78acd85f0", "ja3_variant_count": 1, "ja3_variants": [ "5165922019718c0cf8fa84f78acd85f0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_730db0fdce76", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "730db0fdce76", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-27-0-45-11-5-43-65037-17613-65281-35-51764-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789002920, "last_seen": 1789002920, "transport": "t", "ja3_hash": "19a7eebf94abb8782029234930022f40", "ja3_variant_count": 1, "ja3_variants": [ "19a7eebf94abb8782029234930022f40" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_8b387726ad91", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "8b387726ad91", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-11-23-13-35-65037-45-10-5-0-17613-43-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789603663, "last_seen": 1789603663, "transport": "t", "ja3_hash": "634a5acb2d35f05b0628c5a0fcfefb1d", "ja3_variant_count": 1, "ja3_variants": [ "634a5acb2d35f05b0628c5a0fcfefb1d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_8deda503e862", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "8deda503e862", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-43-27-23-13-65037-17613-65281-10-0-11-5-45-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789906990, "last_seen": 1789906990, "transport": "t", "ja3_hash": "c7fdb27aa93629ce11e0d656b8dc956a", "ja3_variant_count": 1, "ja3_variants": [ "c7fdb27aa93629ce11e0d656b8dc956a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_04db9f4cbeef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "04db9f4cbeef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-65037-18-17613-43-51764-65281-11-5-35-13-0-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789795453, "last_seen": 1789795453, "transport": "t", "ja3_hash": "fb09960f1f920b19659ec2745dad512d", "ja3_variant_count": 1, "ja3_variants": [ "fb09960f1f920b19659ec2745dad512d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_06d0a3ff5c2c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "06d0a3ff5c2c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-13-43-65281-11-10-45-18-16-17613-65037-23-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788444971, "last_seen": 1789656802, "transport": "t", "ja3_hash": "bd8ac2d9cc60665f778002237c732c47", "ja3_variant_count": 2, "ja3_variants": [ "bd8ac2d9cc60665f778002237c732c47", "7e126675ad0ba6cbb7f4f2a037beca20" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_104436a1aaef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "104436a1aaef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-65281-35-5-10-65037-13-45-0-43-18-51764-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789794965, "last_seen": 1789794965, "transport": "t", "ja3_hash": "5b60c03cd9bec620abe6ecebf9045ff7", "ja3_variant_count": 1, "ja3_variants": [ "5b60c03cd9bec620abe6ecebf9045ff7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_171db593f1f5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "171db593f1f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-10-27-65037-17513-13-5-16-45-35-0-23-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789929670, "last_seen": 1789929670, "transport": "t", "ja3_hash": "44581aa20c5e8ee9367238148069d2ef", "ja3_variant_count": 1, "ja3_variants": [ "44581aa20c5e8ee9367238148069d2ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_2b66d956728c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "2b66d956728c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-51764-35-65037-13-43-18-11-45-10-65281-23-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789749894, "last_seen": 1789749894, "transport": "t", "ja3_hash": "4107c617b3cb40009aaf25bbc6780047", "ja3_variant_count": 1, "ja3_variants": [ "4107c617b3cb40009aaf25bbc6780047" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_3241686c8acb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "3241686c8acb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-65037-11-23-43-51764-35-16-5-17613-27-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469870, "last_seen": 1789469870, "transport": "t", "ja3_hash": "8583d782e4511ccd016f46d2642720d0", "ja3_variant_count": 1, "ja3_variants": [ "8583d782e4511ccd016f46d2642720d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_32f48254f361", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "32f48254f361", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-43-0-65037-5-23-13-45-17513-18-35-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789124472, "last_seen": 1789124472, "transport": "t", "ja3_hash": "5ad65bc1576b570ddeabe535f62eb359", "ja3_variant_count": 1, "ja3_variants": [ "5ad65bc1576b570ddeabe535f62eb359" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_61c29ddb3825", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "61c29ddb3825", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-45-35-23-10-17613-65281-16-18-5-0-43-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789391198, "last_seen": 1789391198, "transport": "t", "ja3_hash": "f1810c440f16649b88923ef24e85919f", "ja3_variant_count": 1, "ja3_variants": [ "f1810c440f16649b88923ef24e85919f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_63b09f26f246", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "63b09f26f246", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-35-43-45-27-13-16-51764-23-11-5-10-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508375, "last_seen": 1788508375, "transport": "t", "ja3_hash": "3a11de10d327d7bf41ad91752416bf90", "ja3_variant_count": 1, "ja3_variants": [ "3a11de10d327d7bf41ad91752416bf90" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_7bfca9a91c1b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "7bfca9a91c1b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-17613-65037-18-65281-16-23-45-27-11-0-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788670832, "last_seen": 1788670832, "transport": "t", "ja3_hash": "cca464d9dbc801c9d1fbbf3a43f3c953", "ja3_variant_count": 1, "ja3_variants": [ "cca464d9dbc801c9d1fbbf3a43f3c953" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_824e585b2b31", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "824e585b2b31", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-51764-13-35-17613-65037-10-23-65281-11-43-45-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788514922, "last_seen": 1788514922, "transport": "t", "ja3_hash": "e48aa80d4e5847599287db8ec1621c92", "ja3_variant_count": 1, "ja3_variants": [ "e48aa80d4e5847599287db8ec1621c92" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_8e6441488796", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "8e6441488796", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-16-27-5-45-13-35-10-17613-43-65037-65281-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788552183, "last_seen": 1788552183, "transport": "t", "ja3_hash": "fdf7161a20a266023718b1643081a846", "ja3_variant_count": 1, "ja3_variants": [ "fdf7161a20a266023718b1643081a846" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_91e7438793ab", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "91e7438793ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-65037-23-35-13-0-16-43-10-45-18-65281-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789269662, "last_seen": 1789269662, "transport": "t", "ja3_hash": "7e4548719290f44da16633e97908be26", "ja3_variant_count": 1, "ja3_variants": [ "7e4548719290f44da16633e97908be26" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_968165097b0e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "968165097b0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-43-51764-18-35-0-17613-23-65037-13-65281-45-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789391196, "last_seen": 1789391196, "transport": "t", "ja3_hash": "b8e19b3849f70511060f16ac35cd46f7", "ja3_variant_count": 1, "ja3_variants": [ "b8e19b3849f70511060f16ac35cd46f7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_9c9bbf113d65", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "9c9bbf113d65", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-65281-16-45-35-27-43-23-11-18-5-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789309291, "last_seen": 1789309291, "transport": "t", "ja3_hash": "e75daf8bcd25df2e013cab0af959ee36", "ja3_variant_count": 1, "ja3_variants": [ "e75daf8bcd25df2e013cab0af959ee36" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_a54f389dc709", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "a54f389dc709", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-0-43-10-27-35-16-17613-65281-13-51764-45-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788816026, "last_seen": 1788816026, "transport": "t", "ja3_hash": "5f1abe5a808aaf9dbb693746ffb76298", "ja3_variant_count": 1, "ja3_variants": [ "5f1abe5a808aaf9dbb693746ffb76298" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_a80335266c50", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "a80335266c50", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-0-43-27-18-5-35-11-13-45-10-51764-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469872, "last_seen": 1789469872, "transport": "t", "ja3_hash": "950981128203ee2f9a67f7e17312fb53", "ja3_variant_count": 1, "ja3_variants": [ "950981128203ee2f9a67f7e17312fb53" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_ac9cb79ee855", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "ac9cb79ee855", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-35-5-65037-51764-45-11-13-43-0-23-17613-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789049855, "last_seen": 1789049855, "transport": "t", "ja3_hash": "4c2278002ec5e9d2b327e0056aac5ef0", "ja3_variant_count": 1, "ja3_variants": [ "4c2278002ec5e9d2b327e0056aac5ef0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_b97abf3585a2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "b97abf3585a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-51764-43-65281-11-65037-0-27-23-35-5-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788967533, "last_seen": 1788967533, "transport": "t", "ja3_hash": "0f6e3929fa8b1361a739e69ca32f66df", "ja3_variant_count": 1, "ja3_variants": [ "0f6e3929fa8b1361a739e69ca32f66df" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_bbebbf6fcd10", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "bbebbf6fcd10", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-0-5-18-11-27-10-16-17613-65037-23-13-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789680985, "last_seen": 1789680985, "transport": "t", "ja3_hash": "ab0f71000e2bc4d0949df424981a7dd1", "ja3_variant_count": 1, "ja3_variants": [ "ab0f71000e2bc4d0949df424981a7dd1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_cb5aba928501", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "cb5aba928501", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-51-35-45-0-18-23-65281-43-27-16-5-17613-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789077102, "last_seen": 1789077102, "transport": "t", "ja3_hash": "b339a1596b5acd44b80e69ceb971d132", "ja3_variant_count": 1, "ja3_variants": [ "b339a1596b5acd44b80e69ceb971d132" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_e0cddad42026", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "e0cddad42026", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-0-45-16-18-11-27-43-65281-10-65037-35-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788911288, "last_seen": 1788911288, "transport": "t", "ja3_hash": "d3e92309a0b99467a26ec5e367ce1c72", "ja3_variant_count": 1, "ja3_variants": [ "d3e92309a0b99467a26ec5e367ce1c72" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f6d0a1d840c6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f6d0a1d840c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-65281-18-43-45-0-17613-13-10-16-23-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789782405, "last_seen": 1789782405, "transport": "t", "ja3_hash": "e3bcfd13266be31dd0b07eda5d7d2cb0", "ja3_variant_count": 1, "ja3_variants": [ "e3bcfd13266be31dd0b07eda5d7d2cb0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f7e764339e63", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f7e764339e63", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-51764-10-23-17613-13-27-0-18-5-35-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788595384, "last_seen": 1788595384, "transport": "t", "ja3_hash": "e0657215f5cd73e013625dc810840256", "ja3_variant_count": 1, "ja3_variants": [ "e0657215f5cd73e013625dc810840256" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_fe64589bb50b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "fe64589bb50b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-11-51764-18-13-23-35-16-5-43-17613-0-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789653436, "last_seen": 1789653436, "transport": "t", "ja3_hash": "4c1e757433dd5c82228500dc3f56553b", "ja3_variant_count": 1, "ja3_variants": [ "4c1e757433dd5c82228500dc3f56553b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151600_8daaf6152771_71c124bd0b40", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151600", "b": "8daaf6152771", "c": "71c124bd0b40", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-5-4832-10-23-51764-65037-43-0-45-27-35-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789587738, "last_seen": 1789587738, "transport": "t", "ja3_hash": "96d1821550e125bce79220445fc2cdec", "ja3_variant_count": 1, "ja3_variants": [ "96d1821550e125bce79220445fc2cdec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151600_8daaf6152771_c0c477cde423", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151600", "b": "8daaf6152771", "c": "c0c477cde423", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-43-13-27-45-0-51764-65037-11-35-18-65281-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469871, "last_seen": 1789469871, "transport": "t", "ja3_hash": "39aa9c291432ee40d8ec62345e3a9105", "ja3_variant_count": 1, "ja3_variants": [ "39aa9c291432ee40d8ec62345e3a9105" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151600_8daaf6152771_d9d40f4a71d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151600", "b": "8daaf6152771", "c": "d9d40f4a71d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51764-18-17613-43-65281-13-35-27-45-5-65037-0-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027380, "last_seen": 1789027380, "transport": "t", "ja3_hash": "3e50db706fd0ff040cdea3b3a8f1dcfc", "ja3_variant_count": 1, "ja3_variants": [ "3e50db706fd0ff040cdea3b3a8f1dcfc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_0840309269b6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "0840309269b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-5-17613-0-51764-23-43-65281-10-27-11-16-35-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789906992, "last_seen": 1789906992, "transport": "t", "ja3_hash": "3e718a2153517706b95ff13287047c87", "ja3_variant_count": 1, "ja3_variants": [ "3e718a2153517706b95ff13287047c87" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_0c586802a5fa", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "0c586802a5fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-16-35-27-65281-17613-51764-43-45-18-23-0-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789658275, "last_seen": 1789658275, "transport": "t", "ja3_hash": "c760de83409b1c0776eba2ed454db043", "ja3_variant_count": 1, "ja3_variants": [ "c760de83409b1c0776eba2ed454db043" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_12b110271bcc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "12b110271bcc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-11-18-35-13-16-51764-27-0-65281-17613-43-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789338156, "last_seen": 1789338156, "transport": "t", "ja3_hash": "a0c67b2ee4edb505e8737ce350d12033", "ja3_variant_count": 1, "ja3_variants": [ "a0c67b2ee4edb505e8737ce350d12033" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_14256baa9601", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "14256baa9601", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-27-43-23-0-45-35-16-5-65281-11-13-51764-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789196278, "last_seen": 1789196278, "transport": "t", "ja3_hash": "c1ce0b127dfb321514ed7e9e857c99f9", "ja3_variant_count": 1, "ja3_variants": [ "c1ce0b127dfb321514ed7e9e857c99f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_27b64e10e4de", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "27b64e10e4de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-27-16-10-51764-13-0-35-65037-18-11-17613-65281-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789353217, "last_seen": 1789353217, "transport": "t", "ja3_hash": "71438ca29b024eaf7636552ca6ce2e60", "ja3_variant_count": 1, "ja3_variants": [ "71438ca29b024eaf7636552ca6ce2e60" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_49b3eecc765b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "49b3eecc765b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-27-18-65037-43-13-23-51764-65281-17613-0-16-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789196281, "last_seen": 1789196281, "transport": "t", "ja3_hash": "f1193b978f0ea42e24d569118b040e15", "ja3_variant_count": 1, "ja3_variants": [ "f1193b978f0ea42e24d569118b040e15" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_6a83e66a3bc9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "6a83e66a3bc9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-16-35-43-17613-23-45-65281-13-11-18-65037-10-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788988737, "last_seen": 1788988737, "transport": "t", "ja3_hash": "90d543426da57670d3ae732d97ff6675", "ja3_variant_count": 1, "ja3_variants": [ "90d543426da57670d3ae732d97ff6675" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_9338e1cc4b02", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "9338e1cc4b02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-11-65037-35-43-5-17613-51764-16-23-18-65281-13-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789488137, "last_seen": 1789488137, "transport": "t", "ja3_hash": "4f36f8d9a53fc8624fb0c08411cf4b1f", "ja3_variant_count": 1, "ja3_variants": [ "4f36f8d9a53fc8624fb0c08411cf4b1f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_9bfd97c2868e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "9bfd97c2868e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-18-51764-35-0-43-5-65037-13-10-16-17613-45-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789923855, "last_seen": 1789923855, "transport": "t", "ja3_hash": "5ac63dcd51f9c954fcb2638dfc273492", "ja3_variant_count": 1, "ja3_variants": [ "5ac63dcd51f9c954fcb2638dfc273492" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_a13c1e3390d8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "a13c1e3390d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-51764-43-18-11-65037-65281-16-23-0-17613-35-13-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789729279, "last_seen": 1789729279, "transport": "t", "ja3_hash": "e9ebfdd723a50547e8584558d83b68cc", "ja3_variant_count": 1, "ja3_variants": [ "e9ebfdd723a50547e8584558d83b68cc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_a4aaaa739397", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "a4aaaa739397", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-35-23-13-11-65037-5-43-17613-27-45-0-51764-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788743659, "last_seen": 1788743659, "transport": "t", "ja3_hash": "9d782c00fa959dea4e3d3cc0ce94a65a", "ja3_variant_count": 1, "ja3_variants": [ "9d782c00fa959dea4e3d3cc0ce94a65a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_b3d3ac4dbbfd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "b3d3ac4dbbfd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-35-65037-17613-18-13-10-43-65281-5-27-51764-16-23-51,514-4588-24-23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789387679, "last_seen": 1789387679, "transport": "t", "ja3_hash": "6382a49e55e35731a64fa92e78b9843e", "ja3_variant_count": 1, "ja3_variants": [ "6382a49e55e35731a64fa92e78b9843e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_d109364f852d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "d109364f852d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-17613-10-5-18-16-43-0-13-65037-45-51764-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788441658, "last_seen": 1788441658, "transport": "t", "ja3_hash": "84ab776fcdcef56c079cd6b42ed0546d", "ja3_variant_count": 1, "ja3_variants": [ "84ab776fcdcef56c079cd6b42ed0546d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_eb3f4f7706fd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "eb3f4f7706fd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-13-17613-51764-10-35-65281-43-16-45-5-23-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789063166, "last_seen": 1789063166, "transport": "t", "ja3_hash": "31ac1be7a3c60b702ba8ac2abc47e416", "ja3_variant_count": 1, "ja3_variants": [ "31ac1be7a3c60b702ba8ac2abc47e416" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_15cadc52a526", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "15cadc52a526", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-11-51764-23-65037-18-35-4832-0-16-17613-45-27-43-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789292872, "last_seen": 1789292872, "transport": "t", "ja3_hash": "b3323d59c6e9cbf7210cb5a5a185644a", "ja3_variant_count": 1, "ja3_variants": [ "b3323d59c6e9cbf7210cb5a5a185644a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_18cb75aa8097", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "18cb75aa8097", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-0-11-27-51764-13-45-5-16-23-35-65281-4832-17613-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789386544, "last_seen": 1789386544, "transport": "t", "ja3_hash": "06c115a014f886cc6819f306ec56eaa3", "ja3_variant_count": 1, "ja3_variants": [ "06c115a014f886cc6819f306ec56eaa3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_29e459b1510e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "29e459b1510e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-43-4832-18-0-35-51-16-65281-11-13-5-23-17613-51764-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789386544, "last_seen": 1789386548, "transport": "t", "ja3_hash": "4e28ae3f3c9df64ec989cf59e31cda1f", "ja3_variant_count": 2, "ja3_variants": [ "4e28ae3f3c9df64ec989cf59e31cda1f", "a6c6c50a7537c9da5ba686248be1c559" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_3840b61cd663", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "3840b61cd663", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-35-5-51764-13-17613-10-16-0-27-11-65037-4832-45-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789587735, "last_seen": 1789587735, "transport": "t", "ja3_hash": "6c73bea76cfcd383e774cd047cb04c70", "ja3_variant_count": 1, "ja3_variants": [ "6c73bea76cfcd383e774cd047cb04c70" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_4cb6c97dc859", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "4cb6c97dc859", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-11-18-16-65281-10-45-13-17613-35-5-51764-0-27-4832-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789386542, "last_seen": 1789386542, "transport": "t", "ja3_hash": "a2d2756263c81df5e1f50ee88e6360f8", "ja3_variant_count": 1, "ja3_variants": [ "a2d2756263c81df5e1f50ee88e6360f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_60dbb3a1db10", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "60dbb3a1db10", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-4832-27-45-65281-13-51764-23-16-10-18-43-5-11-35-0-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789386544, "last_seen": 1789386544, "transport": "t", "ja3_hash": "4768821ba9983c5ec19f068f8f00c7bc", "ja3_variant_count": 1, "ja3_variants": [ "4768821ba9983c5ec19f068f8f00c7bc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_836209a337de", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "836209a337de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-13-27-10-51764-18-4832-35-23-43-11-17613-65281-0-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789386547, "last_seen": 1789386547, "transport": "t", "ja3_hash": "5513bbf28f3c08f69cb81cd48ec79ee4", "ja3_variant_count": 1, "ja3_variants": [ "5513bbf28f3c08f69cb81cd48ec79ee4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_929279cec7b9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "929279cec7b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-18-51764-4832-11-51-45-0-16-23-17613-43-10-27-5-35,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789386551, "last_seen": 1789386551, "transport": "t", "ja3_hash": "a96b38919ec0f977fa1f7bff62cb3358", "ja3_variant_count": 1, "ja3_variants": [ "a96b38919ec0f977fa1f7bff62cb3358" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_cf425ff07b50", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "cf425ff07b50", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-4832-27-5-0-17613-18-13-43-23-16-51-35-65281-45-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789386543, "last_seen": 1789386545, "transport": "t", "ja3_hash": "bf3d1471d4d944a5764dc240eedf07e4", "ja3_variant_count": 2, "ja3_variants": [ "bf3d1471d4d944a5764dc240eedf07e4", "730031b335277fc1ca60e26f70ad5ded" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_e7f01c9c10c3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "e7f01c9c10c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-51-43-17613-23-65281-10-51764-18-11-5-0-35-13-27-4832,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789386545, "last_seen": 1789386547, "transport": "t", "ja3_hash": "37d56761e389345daea8322477a1ae80", "ja3_variant_count": 2, "ja3_variants": [ "37d56761e389345daea8322477a1ae80", "774df307cd3553c8cfee2d7746df1061" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_6275101b5ac4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "6275101b5ac4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-51-27-4832-13-65037-16-51764-65281-17613-45-11-10-35-43-0-23,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788842719, "last_seen": 1789012135, "transport": "t", "ja3_hash": "fbf38276b3b188badc21c2666fe07fa2", "ja3_variant_count": 3, "ja3_variants": [ "fbf38276b3b188badc21c2666fe07fa2", "df6891de589e44c9289aaa12d25b4f41", "a0b6e0a8a627c86743e0a4aecdacb982" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_a41cfd0d7ccb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "a41cfd0d7ccb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-11-27-65037-65281-16-35-45-51764-10-0-13-18-43-23-17613-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789702389, "last_seen": 1789744104, "transport": "t", "ja3_hash": "ccd4ad80d8146a8c4700cb00124770fd", "ja3_variant_count": 2, "ja3_variants": [ "ccd4ad80d8146a8c4700cb00124770fd", "af9a3b50149f6647dc97552be7954261" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_f45502ff2921", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "f45502ff2921", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-11-27-51764-0-35-16-10-5-43-18-23-51-17613-4832-13-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788910947, "last_seen": 1788910947, "transport": "t", "ja3_hash": "bb77393d0dc2d4298725f478dbfedfe2", "ja3_variant_count": 1, "ja3_variants": [ "bb77393d0dc2d4298725f478dbfedfe2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1610h2_46e7e9700bed_34c01d0633e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1610h2", "b": "46e7e9700bed", "c": "34c01d0633e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-5-10-11-13-35-16-43-51,4588-4587-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 210, "first_seen": 1787509866, "last_seen": 1789900806, "transport": "t", "ja3_hash": "ca63abdbdae85b0332b1032e455bff7a", "ja3_variant_count": 2, "ja3_variants": [ "ca63abdbdae85b0332b1032e455bff7a", "1becc76b28948474472f56d050c36ff0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1613h2_1711a4c0508c_d9f1b18a60e3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1613h2", "b": "1711a4c0508c", "c": "d9f1b18a60e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-255,0-11-10-35-5-16-18-23-13-43-45-51-21,29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789926414, "last_seen": 1789926692, "transport": "t", "ja3_hash": "7c822e5e821268e8bd01b70e9cad0b85", "ja3_variant_count": 1, "ja3_variants": [ "7c822e5e821268e8bd01b70e9cad0b85" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1613h2_8b7ed0b7403b_277dd3cf83a4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1613h2", "b": "8b7ed0b7403b", "c": "277dd3cf83a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865-49191-49187-52393-157-52392-49196-49199-156-49200-60-49161-49162-49170,21-11-10-43-51-45-16-0-13-35-5-65281-23,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 21, "name": "padding", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788700627, "last_seen": 1788700627, "transport": "t", "ja3_hash": "33e7f24650158d46e9a9ff06afe74d01", "ja3_variant_count": 1, "ja3_variants": [ "33e7f24650158d46e9a9ff06afe74d01" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1614h2_9e7ea7ef26e6_5e84a08b8441", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1614h2", "b": "9e7ea7ef26e6", "c": "5e84a08b8441", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-157-52393-60-156-49200-49199-53-49171-10-47-49161-49172,35-11-0-43-17513-16-23-5-65281-10-51-13-18-45,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788907516, "last_seen": 1788907516, "transport": "t", "ja3_hash": "081ad0458b6b47543b8c744ac402f20f", "ja3_variant_count": 1, "ja3_variants": [ "081ad0458b6b47543b8c744ac402f20f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d171000_5b57614c22b0_56fbe12fd207", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d171000", "b": "5b57614c22b0", "c": "56fbe12fd207", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49196-52393-49199-49200-52392-49161-49162-49171-49172-156-157-47-53,0-23-65281-10-11-5-13-51-45-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788230188, "last_seen": 1789909971, "transport": "t", "ja3_hash": "c4d9c7fc50e1fd2ebf09e3d9a2a31b33", "ja3_variant_count": 1, "ja3_variants": [ "c4d9c7fc50e1fd2ebf09e3d9a2a31b33" ], "user_agents": { "ZoominfoBot (zoominfobot at zoominfo dot com)": 6 }, "ua_disagreement": false } }, { "hash": "t13d171100_5b57614c22b0_6b891f5cadd1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d171100", "b": "5b57614c22b0", "c": "6b891f5cadd1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49196-52393-49199-49200-52392-49161-49162-49171-49172-156-157-47-53,0-23-65281-10-11-5-13-51-45-43-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788230186, "last_seen": 1789909972, "transport": "t", "ja3_hash": "33b38c8778b29bc991b5200b6141f35e", "ja3_variant_count": 1, "ja3_variants": [ "33b38c8778b29bc991b5200b6141f35e" ], "user_agents": { "ZoominfoBot (zoominfobot at zoominfo dot com)": 6 }, "ua_disagreement": false } }, { "hash": "t13d1713ht_5b57614c22b0_73c8ae8dda93", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1713ht", "b": "5b57614c22b0", "c": "73c8ae8dda93", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788548726, "last_seen": 1789868558, "transport": "t", "ja3_hash": "1523504b38f0fae0d881d4b6554aac1b", "ja3_variant_count": 1, "ja3_variants": [ "1523504b38f0fae0d881d4b6554aac1b" ], "user_agents": { "Bun/1.4.2": 13, "Bun/1.4.1": 2 }, "ua_disagreement": false } }, { "hash": "t13d1713ht_5b57614c22b0_a1c857e0187c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1713ht", "b": "5b57614c22b0", "c": "a1c857e0187c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49196-52393-49199-49200-52392-49161-49162-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-51-45-43-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789494050, "last_seen": 1789494053, "transport": "t", "ja3_hash": "c67e9dc27d283f1f89b4ebb4b4670c21", "ja3_variant_count": 1, "ja3_variants": [ "c67e9dc27d283f1f89b4ebb4b4670c21" ], "user_agents": { "WhatsApp/2.23.20.0": 4 }, "ua_disagreement": false } }, { "hash": "t13d1810h2_29a2cd9e9f10_4a1f08c76dc1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1810h2", "b": "29a2cd9e9f10", "c": "4a1f08c76dc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-51-57-47-53-10,65281-0-5-10-11-13-35-16-43-51,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787509869, "last_seen": 1789900804, "transport": "t", "ja3_hash": "9626b0ce2d7692abf2455051ab4b1b9c", "ja3_variant_count": 1, "ja3_variants": [ "9626b0ce2d7692abf2455051ab4b1b9c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1813h2_b672a73b9056_5426470b89c9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1813h2", "b": "b672a73b9056", "c": "5426470b89c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865-52393-60-49196-49187-156-49195-49199-157-49200-10-49162-49171-49161-47-53,11-13-5-35-23-51-43-10-45-18-0-65281-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789286602, "last_seen": 1789286602, "transport": "t", "ja3_hash": "a0cc2f1164259fcbc7b4ec6a1d6f0245", "ja3_variant_count": 1, "ja3_variants": [ "a0cc2f1164259fcbc7b4ec6a1d6f0245" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1814h2_29a2cd9e9f10_84f228ded5bd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1814h2", "b": "29a2cd9e9f10", "c": "84f228ded5bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-51-57-47-53-10,0-23-65281-10-11-35-16-5-51-43-13-45-28-21,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787753290, "last_seen": 1789147155, "transport": "t", "ja3_hash": "b20b44b18b853ef29ab773e921b03422", "ja3_variant_count": 1, "ja3_variants": [ "b20b44b18b853ef29ab773e921b03422" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d191100_0682645293b3_665d9ee1cc2f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d191100", "b": "0682645293b3", "c": "665d9ee1cc2f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-52393-52392-60-49191-49187-156-49196-49195-157-49200-49171-49161-49170-49162-53-10,11-5-0-43-51-35-45-23-10-65281-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789896180, "last_seen": 1789896180, "transport": "t", "ja3_hash": "d5df376c5785942d6228d119912d1454", "ja3_variant_count": 1, "ja3_variants": [ "d5df376c5785942d6228d119912d1454" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1913h2_81b38ba04ab7_661bee32bcd9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1913h2", "b": "81b38ba04ab7", "c": "661bee32bcd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865-49191-156-52393-49196-157-60-49195-49200-49187-49162-47-10-49170-49171-53-49172,23-5-21-10-0-35-45-51-11-43-16-65281-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789754539, "last_seen": 1789754539, "transport": "t", "ja3_hash": "0a6d051b99c01f19a7d0512d993d9e71", "ja3_variant_count": 1, "ja3_variants": [ "0a6d051b99c01f19a7d0512d993d9e71" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d201100_2b729b4bf6f3_f8f1377fd325", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d201100", "b": "2b729b4bf6f3", "c": "f8f1377fd325", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-5-43-13-35-10-51-49-23-65281-45,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 20, "first_seen": 1787782365, "last_seen": 1789804648, "transport": "t", "ja3_hash": "3c293bdf2a25c07559b560ba86debc77", "ja3_variant_count": 1, "ja3_variants": [ "3c293bdf2a25c07559b560ba86debc77" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 9, "Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.1)": 1 }, "ua_disagreement": false } }, { "hash": "t13d2011h2_d71cdf2c13a7_70bf55093985", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2011h2", "b": "d71cdf2c13a7", "c": "70bf55093985", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-157-49187-49195-49200-52393-49196-60-52392-49199-156-49170-53-49172-47-49171-10-49162,13-11-23-35-5-43-16-45-51-10-0,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789216361, "last_seen": 1789216361, "transport": "t", "ja3_hash": "d5f9c01689f6c575b43c0c0d37ee12a1", "ja3_variant_count": 1, "ja3_variants": [ "d5f9c01689f6c575b43c0c0d37ee12a1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2014h2_a09f3c656075_cbe3c5c47ebd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d2014h2", "b": "a09f3c656075", "c": "cbe3c5c47ebd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-41,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789703758, "last_seen": 1789703758, "transport": "t", "ja3_hash": "7afab366a384524b5f6e3f1fdf084ed6", "ja3_variant_count": 1, "ja3_variants": [ "7afab366a384524b5f6e3f1fdf084ed6" ], "user_agents": { "dp-discover/1.0 (+https://godigitalpigeon.com/bot)": 1 }, "ua_disagreement": false } }, { "hash": "t13d2015h2_17e9a8af7860_380c79957f8f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2015h2", "b": "17e9a8af7860", "c": "380c79957f8f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-157-52392-52393-49199-49187-49195-49191-60-156-49196-49161-49172-49162-53-49171-10-47,16-5-11-13-51-35-18-21-17513-45-10-65281-43-23-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789761448, "last_seen": 1789761448, "transport": "t", "ja3_hash": "8617543f4d007d9a954d5c8d60e9c290", "ja3_variant_count": 1, "ja3_variants": [ "8617543f4d007d9a954d5c8d60e9c290" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d210800_bb0fcf8f19ae_565c6736bc0c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d210800", "b": "bb0fcf8f19ae", "c": "565c6736bc0c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-49195-49199-49196-49200-52393-52392-49171-49172-158-159-156-157-47-53-10-255,0-23-35-13-11-10-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788868032, "last_seen": 1788868032, "transport": "t", "ja3_hash": "c5aab6de2edb73d37015a409db665fe2", "ja3_variant_count": 1, "ja3_variants": [ "c5aab6de2edb73d37015a409db665fe2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2111h2_27eb464290be_7e6ea3086605", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2111h2", "b": "27eb464290be", "c": "7e6ea3086605", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-52392-49195-52393-49187-49191-157-60-156-49199-49172-49161-49171-49170-10-47-53-49162,35-0-45-23-10-51-43-16-5-13-11,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789817897, "last_seen": 1789817897, "transport": "t", "ja3_hash": "e2d31475c912f74dc5757d6aa837ed39", "ja3_variant_count": 1, "ja3_variants": [ "e2d31475c912f74dc5757d6aa837ed39" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d211200_cbb8954facf6_8a58e916c4e1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d211200", "b": "cbb8954facf6", "c": "8a58e916c4e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4867-4866-4865-49195-49196-49187-52392-52393-157-49199-49200-156-60-10-49170-49172-49161-49171-53-47-49162,18-10-35-0-11-23-5-45-51-65281-43-13,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789808848, "last_seen": 1789808848, "transport": "t", "ja3_hash": "b8a131b22b910f60364b3009eee2c432", "ja3_variant_count": 1, "ja3_variants": [ "b8a131b22b910f60364b3009eee2c432" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2112h2_ec0dba2c1a22_6fccd2e4d827", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2112h2", "b": "ec0dba2c1a22", "c": "6fccd2e4d827", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49191-52392-49187-156-49200-49199-49196-157-60-49195-47-10-49171-49170-49172-49162-49161-53,10-45-5-13-16-23-43-11-0-35-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789015947, "last_seen": 1789015947, "transport": "t", "ja3_hash": "8eb8cb5d2ea13e1c6ca30f14c621a98f", "ja3_variant_count": 1, "ja3_variants": [ "8eb8cb5d2ea13e1c6ca30f14c621a98f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2113h2_84d092389717_687dbf40044d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2113h2", "b": "84d092389717", "c": "687dbf40044d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-52392-49191-49195-49199-156-157-49196-60-49187-49200-52393-10-49171-47-49170-49161-53-49172,43-65281-11-16-13-23-35-51-45-5-10-21-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789746001, "last_seen": 1789746001, "transport": "t", "ja3_hash": "27015a42021824a4d620602e8187312e", "ja3_variant_count": 1, "ja3_variants": [ "27015a42021824a4d620602e8187312e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2212h2_231e334592e8_ce35c396a636", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d2212h2", "b": "231e334592e8", "c": "ce35c396a636", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-16-51-49-23-65281-45-41,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789223343, "last_seen": 1789738880, "transport": "t", "ja3_hash": "2470f363b30ea74adfde345b4e84a7b8", "ja3_variant_count": 1, "ja3_variants": [ "2470f363b30ea74adfde345b4e84a7b8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 189 }, "ua_disagreement": false } }, { "hash": "t13d2309h2_bc6434d430c8_2977e3beeb43", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2309h2", "b": "bc6434d430c8", "c": "2977e3beeb43", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 23, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-4868-4869-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-158-159-156-157-47-53-10-255,0-23-13-11-10-43-16-45-51,29-23-24-25-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787558096, "last_seen": 1789887992, "transport": "t", "ja3_hash": "133e24b7641cba6242249229374d88fb", "ja3_variant_count": 2, "ja3_variants": [ "133e24b7641cba6242249229374d88fb", "8d2da38d73b3904ef23dc62220d682be" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d251100_b78ed14e2fd0_4ecd95ca9718", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d251100", "b": "b78ed14e2fd0", "c": "4ecd95ca9718", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 25, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788460427, "last_seen": 1789883822, "transport": "t", "ja3_hash": "e462a2d49ed929ffb9992303209802d1", "ja3_variant_count": 1, "ja3_variants": [ "e462a2d49ed929ffb9992303209802d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2610h2_2802a3db6c62_af16a61e292d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2610h2", "b": "2802a3db6c62", "c": "af16a61e292d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 26, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-49196-49195-49188-49187-49162-49161-52393-49200-49199-49192-49191-49172-49171-52392-157-156-61-60-53-47-49160-49170-10,65281-0-5-10-11-13-13172-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 70, "first_seen": 1787509867, "last_seen": 1789900806, "transport": "t", "ja3_hash": "8a4db2db564bf8abeee77aa435a9a1d8", "ja3_variant_count": 1, "ja3_variants": [ "8a4db2db564bf8abeee77aa435a9a1d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2912h2_723694b0fccc_62e135c949f9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d2912h2", "b": "723694b0fccc", "c": "62e135c949f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 29, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-4868-49196-52393-49325-49162-49195-49324-49161-49200-52392-49172-49199-49171-157-49309-53-156-49308-47-159-52394-49311-57-158-49310-51,13-16-5-10-28-22-0-43-65281-23-11-51,23-24-25-29-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789619509, "last_seen": 1789619509, "transport": "t", "ja3_hash": "530ee99d727e4a08ffdee109609239d9", "ja3_variant_count": 1, "ja3_variants": [ "530ee99d727e4a08ffdee109609239d9" ], "user_agents": { "git/2.43.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d2914h2_723694b0fccc_eb2f5f0023c9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d2914h2", "b": "723694b0fccc", "c": "eb2f5f0023c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 29, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-4868-49196-52393-49325-49162-49195-49324-49161-49200-52392-49172-49199-49171-157-49309-53-156-49308-47-159-52394-49311-57-158-49310-51,16-35-13-45-28-23-43-51-22-65281-5-11-0-10,23-24-25-29-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789619446, "last_seen": 1789619446, "transport": "t", "ja3_hash": "a02adf7c049910f605f0faa0ee0fa1d6", "ja3_variant_count": 1, "ja3_variants": [ "a02adf7c049910f605f0faa0ee0fa1d6" ], "user_agents": { "git/2.53.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d3010ht_1d37bd780c83_2940b37ac0ce", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d3010ht", "b": "1d37bd780c83", "c": "2940b37ac0ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,43-11-10-65281-0-16-13-23-45-51,29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789181424, "last_seen": 1789181424, "transport": "t", "ja3_hash": "458066803225bb2183a650629f84acc3", "ja3_variant_count": 1, "ja3_variants": [ "458066803225bb2183a650629f84acc3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d301100_1d37bd780c83_270ffd6f0af9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d301100", "b": "1d37bd780c83", "c": "270ffd6f0af9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-10-35-22-23-13-43-45-51-27,4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789129677, "last_seen": 1789129677, "transport": "t", "ja3_hash": "504f4b612cfb4114ccc67729d387723b", "ja3_variant_count": 1, "ja3_variants": [ "504f4b612cfb4114ccc67729d387723b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d301300_1d37bd780c83_d0a5066ca47b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d301300", "b": "1d37bd780c83", "c": "d0a5066ca47b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-5-22-23-13-43-45-51-27,4588-4587-4589-25497-25498-12092-12093-570-572-573-512-513-514-580-581-582-12100-12208-516-515-517-12032-12160-29-30-23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 25498, "name": "25498 (0x639a)", "known": false }, { "value": 12092, "name": "12092 (0x2f3c)", "known": false }, { "value": 12093, "name": "12093 (0x2f3d)", "known": false }, { "value": 570, "name": "570 (0x023a)", "known": false }, { "value": 572, "name": "572 (0x023c)", "known": false }, { "value": 573, "name": "573 (0x023d)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 580, "name": "580 (0x0244)", "known": false }, { "value": 581, "name": "581 (0x0245)", "known": false }, { "value": 582, "name": "582 (0x0246)", "known": false }, { "value": 12100, "name": "12100 (0x2f44)", "known": false }, { "value": 12208, "name": "12208 (0x2fb0)", "known": false }, { "value": 516, "name": "516 (0x0204)", "known": false }, { "value": 515, "name": "515 (0x0203)", "known": false }, { "value": 517, "name": "517 (0x0205)", "known": false }, { "value": 12032, "name": "12032 (0x2f00)", "known": false }, { "value": 12160, "name": "12160 (0x2f80)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5279, "first_seen": 1787442805, "last_seen": 1789897248, "transport": "t", "ja3_hash": "5bb06b0330d11973e4dc558f5fccd10f", "ja3_variant_count": 2, "ja3_variants": [ "5bb06b0330d11973e4dc558f5fccd10f", "84e5d38a9a4494313b37f385eeb74ba3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d3014h2_1d37bd780c83_17ac7a7984ce", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d3014h2", "b": "1d37bd780c83", "c": "17ac7a7984ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51-27-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2187, "first_seen": 1787442811, "last_seen": 1789313145, "transport": "t", "ja3_hash": "11334b3fbd23edf608d61f771bc2f1d6", "ja3_variant_count": 1, "ja3_variants": [ "11334b3fbd23edf608d61f771bc2f1d6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d3014h2_1d37bd780c83_b8a067fa89f2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d3014h2", "b": "1d37bd780c83", "c": "b8a067fa89f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-16-22-23-49-13-43-45-51-27-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 13, "first_seen": 1788489868, "last_seen": 1788490409, "transport": "t", "ja3_hash": "2fccaedf5c014eb2ab6bbb4a73fdfc87", "ja3_variant_count": 1, "ja3_variants": [ "2fccaedf5c014eb2ab6bbb4a73fdfc87" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d310700_e8f1e7e78f70_9b05390bb1b0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d310700", "b": "e8f1e7e78f70", "c": "9b05390bb1b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-10-11-13-35-43-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787509868, "last_seen": 1789900806, "transport": "t", "ja3_hash": "c28ad0f183cfd790592a25e3dcb9d54b", "ja3_variant_count": 1, "ja3_variants": [ "c28ad0f183cfd790592a25e3dcb9d54b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d310900_e8f1e7e78f70_47d8a05ee563", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d310900", "b": "e8f1e7e78f70", "c": "47d8a05ee563", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-10-35-22-23-13-43-45-51,4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788989756, "last_seen": 1788989761, "transport": "t", "ja3_hash": "8c8a5254dca4d8541f62b597efaab2c9", "ja3_variant_count": 1, "ja3_variants": [ "8c8a5254dca4d8541f62b597efaab2c9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d311100_e8f1e7e78f70_dd22a05640e6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d311100", "b": "e8f1e7e78f70", "c": "dd22a05640e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-5-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 11, "first_seen": 1787697751, "last_seen": 1789425146, "transport": "t", "ja3_hash": "46bb4b3029ca544e39e1c0a2783e2de5", "ja3_variant_count": 1, "ja3_variants": [ "46bb4b3029ca544e39e1c0a2783e2de5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d311200_e8f1e7e78f70_47129f976243", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d311200", "b": "e8f1e7e78f70", "c": "47129f976243", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-5-13172-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 11, "first_seen": 1787697749, "last_seen": 1789425146, "transport": "t", "ja3_hash": "27aa226a438f84089010afba37b2351b", "ja3_variant_count": 1, "ja3_variants": [ "27aa226a438f84089010afba37b2351b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d311200_e8f1e7e78f70_8f5ca734410c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d311200", "b": "e8f1e7e78f70", "c": "8f5ca734410c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-158-49188-49192-49187-49191-107-103-49162-49172-49161-49171-57-51-157-156-61-60-53-47-255,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789798587, "last_seen": 1789944340, "transport": "t", "ja3_hash": "60f3e2285bc991c380f822c6ac51f947", "ja3_variant_count": 1, "ja3_variants": [ "60f3e2285bc991c380f822c6ac51f947" ], "user_agents": { "Mozilla/5.0 (compatible; Dataprovider.com)": 2 }, "ua_disagreement": false } }, { "hash": "t13d3212ht_3af914e56c9f_6c7c91134a62", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d3212ht", "b": "3af914e56c9f", "c": "6c7c91134a62", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 32, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-156-49199-158-60-49191-103-157-49200-159-61-49192-107-49195-49187-49188-49196-47-49171-51-53-49172-57-65-69-132-136-49161-49162-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788857157, "last_seen": 1788857157, "transport": "t", "ja3_hash": "ef7283234da38dfbe83895870b4b6903", "ja3_variant_count": 1, "ja3_variants": [ "ef7283234da38dfbe83895870b4b6903" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d351200_bfa337485184_6c7ee535e33c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d351200", "b": "bfa337485184", "c": "6c7ee535e33c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-22-23-13-43-45-51-27,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 22, "first_seen": 1788104964, "last_seen": 1789919447, "transport": "t", "ja3_hash": "79528b91a7d3b362447f5c890f9fb708", "ja3_variant_count": 1, "ja3_variants": [ "79528b91a7d3b362447f5c890f9fb708" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d361200_36d08471d71c_f0d148687978", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d361200", "b": "36d08471d71c", "c": "f0d148687978", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-156-60-47-4866-4867-157-61-53-255-49195-49199-49187-49191-49197-49201-49189-49193-49161-49171-49156-49166-49196-52393-49200-52392-49188-49192-49198-49202-49190-49194-49162-49172-49157-49167,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 25, "first_seen": 1787516563, "last_seen": 1789042001, "transport": "t", "ja3_hash": "99d04075b77af7a09af10580f3c69459", "ja3_variant_count": 1, "ja3_variants": [ "99d04075b77af7a09af10580f3c69459" ], "user_agents": { "Mozilla/5.0 (compatible; Pinterestbot/1.0; +http://www.pinterest.com/bot.html)": 25 }, "ua_disagreement": false } }, { "hash": "t13d361300_6f3f643b658b_78c283992b26", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d361300", "b": "6f3f643b658b", "c": "78c283992b26", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49200-49196-49199-49195-159-158-57-136-51-49172-49169-49171-22-49159-69-19-49161-49162-49160-49170-50-56-68-135-132-53-150-65-5-47-7-10-255,18-0-11-10-35-5-13172-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 12, "first_seen": 1789125203, "last_seen": 1789289597, "transport": "t", "ja3_hash": "d7b8472451a7e80ecf05084d9df3fb1c", "ja3_variant_count": 1, "ja3_variants": [ "d7b8472451a7e80ecf05084d9df3fb1c" ], "user_agents": { "Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; +info@netcraft.com)": 12 }, "ua_disagreement": false } }, { "hash": "t13d3613h2_6f3f643b658b_1f097b6bf5de", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d3613h2", "b": "6f3f643b658b", "c": "1f097b6bf5de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49200-49196-49199-49195-159-158-57-136-51-49172-49169-49171-22-49159-69-19-49161-49162-49160-49170-50-56-68-135-132-53-150-65-5-47-7-10-255,18-0-11-10-35-5-16-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789125253, "last_seen": 1789125253, "transport": "t", "ja3_hash": "a84c55f4a54b924b0b5ec7720ca1770c", "ja3_variant_count": 1, "ja3_variants": [ "a84c55f4a54b924b0b5ec7720ca1770c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d3613ht_018971650b2c_8bf37a09d688", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d3613ht", "b": "018971650b2c", "c": "8bf37a09d688", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,0-11-10-35-16-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789553823, "last_seen": 1789789737, "transport": "t", "ja3_hash": "f353ae44df6b4c7735fba2dc8cd86fc2", "ja3_variant_count": 1, "ja3_variants": [ "f353ae44df6b4c7735fba2dc8cd86fc2" ], "user_agents": { "Mozilla/5.0 (compatible; SpiderLing; +https://www.sketchengine.eu/crawler/)": 4 }, "ua_disagreement": false } }, { "hash": "t13d3710ht_5c443a9f7afe_2c84df4778f7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d3710ht", "b": "5c443a9f7afe", "c": "2c84df4778f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 37, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47-255,0-11-10-16-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788301264, "last_seen": 1789921765, "transport": "t", "ja3_hash": "b65319aa58f498280e22c172df6fb2bb", "ja3_variant_count": 1, "ja3_variants": [ "b65319aa58f498280e22c172df6fb2bb" ], "user_agents": { "Mozilla/5.0 (compatible; crawler)": 8 }, "ua_disagreement": false } }, { "hash": "t13d450700_d524c25c267f_566b5f938b58", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d450700", "b": "d524c25c267f", "c": "566b5f938b58", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 45, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-49196-49195-49200-157-49198-49202-159-163-49199-156-49197-49201-158-162-49188-49192-61-49190-49194-107-106-49162-49172-53-49157-49167-57-56-49187-49191-60-49189-49193-103-64-49161-49171-47-49156-49166-51-50-255,0-5-10-11-13-43-51,23-24-25-9-10-11-12-13-14-22-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787509868, "last_seen": 1789900804, "transport": "t", "ja3_hash": "2a0034455153e5151f731d3cd4b381a9", "ja3_variant_count": 1, "ja3_variants": [ "2a0034455153e5151f731d3cd4b381a9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d451100_d524c25c267f_afd444485979", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d451100", "b": "d524c25c267f", "c": "afd444485979", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 45, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-49196-49195-49200-157-49198-49202-159-163-49199-156-49197-49201-158-162-49188-49192-61-49190-49194-107-106-49162-49172-53-49157-49167-57-56-49187-49191-60-49189-49193-103-64-49161-49171-47-49156-49166-51-50-255,0-5-10-11-13-50-17-23-43-45-51,23-24-25-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787547891, "last_seen": 1789966847, "transport": "t", "ja3_hash": "6f0d86606b7ca191fbd2c072e4f99f9f", "ja3_variant_count": 1, "ja3_variants": [ "6f0d86606b7ca191fbd2c072e4f99f9f" ], "user_agents": { "YisouSpider": 16 }, "ua_disagreement": false } }, { "hash": "t13d490700_bd868743f55c_566b5f938b58", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d490700", "b": "bd868743f55c", "c": "566b5f938b58", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49196-49195-52393-49200-52392-157-49198-49202-159-52394-163-49199-156-49197-49201-158-162-49188-49192-61-49190-49194-107-106-49162-49172-53-49157-49167-57-56-49187-49191-60-49189-49193-103-64-49161-49171-47-49156-49166-51-50-255,0-5-10-11-13-43-51,23-24-25-9-10-11-12-13-14-22-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787509869, "last_seen": 1789900808, "transport": "t", "ja3_hash": "6e1c812546420ab8c6d23ef281c1e46b", "ja3_variant_count": 1, "ja3_variants": [ "6e1c812546420ab8c6d23ef281c1e46b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d491100_bd868743f55c_afd444485979", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d491100", "b": "bd868743f55c", "c": "afd444485979", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-5-10-11-13-50-17-23-43-45-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789812540, "last_seen": 1789812540, "transport": "t", "ja3_hash": "2c7b42976f538f0759bad05220ba8e2d", "ja3_variant_count": 1, "ja3_variants": [ "2c7b42976f538f0759bad05220ba8e2d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d591000_a33745022dd6_7ef8eb972a3c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d591000", "b": "a33745022dd6", "c": "7ef8eb972a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 59, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 8, "first_seen": 1789798607, "last_seen": 1789953384, "transport": "t", "ja3_hash": "398430069e0a8ecfbc8db0778d658d77", "ja3_variant_count": 1, "ja3_variants": [ "398430069e0a8ecfbc8db0778d658d77" ], "user_agents": { "Mozilla/5.0 (compatible; Dataprovider.com)": 8 }, "ua_disagreement": false } }, { "hash": "t13d6412ht_0f757fa8abd0_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d6412ht", "b": "0f757fa8abd0", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 64, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 901, "first_seen": 1787442803, "last_seen": 1789965998, "transport": "t", "ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a", "ja3_variant_count": 1, "ja3_variants": [ "917fde1bf3bcb67f961b77b18d9ee14a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d691200_ea0618708e31_b613c2328c02", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d691200", "b": "ea0618708e31", "c": "b613c2328c02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": null } }, "ja3_string": "771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 17, "first_seen": 1787457277, "last_seen": 1789620110, "transport": "t", "ja3_hash": "4ab40ed46d2f0f15292e2ccc59b55f0d", "ja3_variant_count": 1, "ja3_variants": [ "4ab40ed46d2f0f15292e2ccc59b55f0d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d6912hq_ea0618708e31_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d6912hq", "b": "ea0618708e31", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "hq" } }, "ja3_string": "771,49170-49171-49159-49191-52244-49199-4865-49172-4866-49192-52393-49200-49267-49248-49266-49249-49196-49270-49327-49271-49325-52392-49188-4869-49162-4868-49195-4867-49326-52243-49324-49169-49187-10-49161-47-49160-60-154-49308-196-49312-136-156-190-53-69-61-159-49309-49315-49313-49311-157-107-65-57-186-158-132-49314-192-49310-7-103-4-51-5-22,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 900, "first_seen": 1787442807, "last_seen": 1789965998, "transport": "t", "ja3_hash": "7f9ae904ef5a8d37a4028ce5c57bc099", "ja3_variant_count": 1, "ja3_variants": [ "7f9ae904ef5a8d37a4028ce5c57bc099" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d6912ht_ea0618708e31_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d6912ht", "b": "ea0618708e31", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788743676, "last_seen": 1789450273, "transport": "t", "ja3_hash": "52368c7984e30470fecde4ccbe536874", "ja3_variant_count": 1, "ja3_variants": [ "52368c7984e30470fecde4ccbe536874" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d731000_613d769af9d7_ac712e70b3b6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d731000", "b": "613d769af9d7", "c": "ac712e70b3b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 73, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49235-49195-49199-158-49326-49324-49314-49310-49244-49248-49234-49188-49192-107-49267-49271-196-49187-49191-103-49266-49270-190-49162-49172-57-136-49161-49171-51-154-69-49159-49169-49160-49170-22-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-150-65-5-10-255,0-11-10-22-23-13-43-45-51-21,23,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789562622, "last_seen": 1789562622, "transport": "t", "ja3_hash": "baa0ce13c28851c288f2ea0798d2f7ce", "ja3_variant_count": 1, "ja3_variants": [ "baa0ce13c28851c288f2ea0798d2f7ce" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d740800_57a946f9b90a_6778c390f8b7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d740800", "b": "57a946f9b90a", "c": "6778c390f8b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 74, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49200-49199-159-158-52392-52394-157-156-49192-49172-49191-49171-107-57-103-51-61-60-53-47-49229-49228-49221-196-136-190-69-49220-49213-192-132-186-49212-65-154-150-22-49170-10-49169-5-4-21-9-49196-49195-52393-49188-49187-49162-49161-49224-49225-49160-49159-163-162-106-64-50-56-49219-195-135-189-49218-68-153-19-18-255,43-11-10-0-13-23-45-51,29-30-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788833921, "last_seen": 1788933498, "transport": "t", "ja3_hash": "2ada28a3c5bb56da6981359ecda88132", "ja3_variant_count": 2, "ja3_variants": [ "2ada28a3c5bb56da6981359ecda88132", "086919a3c1012de1d9ce4dd39c02f67e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d740800_57a946f9b90a_bb8c20482853", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d740800", "b": "57a946f9b90a", "c": "bb8c20482853", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 74, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49200-49199-159-158-52392-52394-157-156-49192-49172-49191-49171-107-57-103-51-61-60-53-47-49229-49228-49221-196-136-190-69-49220-49213-192-132-186-49212-65-154-150-22-49170-10-49169-5-4-21-9-49196-49195-52393-49188-49187-49162-49161-49224-49225-49160-49159-163-162-106-64-50-56-49219-195-135-189-49218-68-153-19-18-255,43-11-10-0-13-23-45-51,29-30-23-24-25-26-27-28-22-10-9-12-11-14-13-8-7-6-21-20-5-4-19-18-2-3-1-16-17-15,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789055334, "last_seen": 1789055334, "transport": "t", "ja3_hash": "b1179b4364af89be0558f0772ead2102", "ja3_variant_count": 1, "ja3_variants": [ "b1179b4364af89be0558f0772ead2102" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i0306ht_55b375c5d22e_c4674d4f439d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i0306ht", "b": "55b375c5d22e", "c": "c4674d4f439d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4867-4866-4865,43-10-51-13-16-58,23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 127, "first_seen": 1787497604, "last_seen": 1789961361, "transport": "t", "ja3_hash": "65bd2d0dd766e11ea0569bd103303509", "ja3_variant_count": 1, "ja3_variants": [ "65bd2d0dd766e11ea0569bd103303509" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i0308h2_55b375c5d22e_f150a32a4db6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i0308h2", "b": "55b375c5d22e", "c": "f150a32a4db6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865,43-10-51-13-16-45-28-58,25-24-23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "curves": [ { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 65, "first_seen": 1787497567, "last_seen": 1789961361, "transport": "t", "ja3_hash": "d76e2a7867d2a625c20b11ae64315363", "ja3_variant_count": 1, "ja3_variants": [ "d76e2a7867d2a625c20b11ae64315363" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i0311h2_55b375c5d22e_efd07e248838", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i0311h2", "b": "55b375c5d22e", "c": "efd07e248838", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865,43-10-51-13-16-27-28-17513-49-45-58,24-23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 64, "first_seen": 1787497537, "last_seen": 1789961361, "transport": "t", "ja3_hash": "a36685c7f7e7d3f87710730524787b6f", "ja3_variant_count": 1, "ja3_variants": [ "a36685c7f7e7d3f87710730524787b6f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1010ht_61a7ad8aa9b6_130134e41230", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13i1010ht", "b": "61a7ad8aa9b6", "c": "130134e41230", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-45-35-16-43-51-13-5-10-11,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1789201622, "last_seen": 1789900881, "transport": "t", "ja3_hash": "5f2285c3bff74a92cfca2989c25235b4", "ja3_variant_count": 16, "ja3_variants": [ "5f2285c3bff74a92cfca2989c25235b4", "deab29f24910632a02df33021095dcf7", "41c24fe194e4cab0e78eef7af5edfda3", "b953cc46e127df0aaa9f087958435c06", "b2336f7eb0e1f609383863450754d807", "3e65a260a0838fffbb28a1fbbe463f05", "fe9a0dd6fe99bcfc8e6c63ef39de9289", "17de125054d0a3a7f9ffb244cd378601", "c3df3971f533a219106db2825e7e1219", "f16ff8c46804e0e432fb1ff3412de32d", "3358e687c3ce450c34e8b7f0666431e8", "977f921e1298449ab4be0ff0583a94da" ], "user_agents": { "odin-scanner/0.4": 15 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_8dab02b44749", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "8dab02b44749", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789654107, "last_seen": 1789654107, "transport": "t", "ja3_hash": "6a77f8224661253c4b10abcc02ea97e1", "ja3_variant_count": 1, "ja3_variants": [ "6a77f8224661253c4b10abcc02ea97e1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_d260895d0103", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "d260895d0103", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-16-43-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789704612, "last_seen": 1789704612, "transport": "t", "ja3_hash": "914fe4b02a3fa3670d4ffb7e8fbba207", "ja3_variant_count": 1, "ja3_variants": [ "914fe4b02a3fa3670d4ffb7e8fbba207" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_ff2a414e0694", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "ff2a414e0694", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-23-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789218775, "last_seen": 1789218775, "transport": "t", "ja3_hash": "e3da5653aa9a1f3200c58920cef47200", "ja3_variant_count": 1, "ja3_variants": [ "e3da5653aa9a1f3200c58920cef47200" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_ffda38ea41c2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "ffda38ea41c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-65037-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789701012, "last_seen": 1789701012, "transport": "t", "ja3_hash": "e67dee91595be601a988d65c46ef4ec7", "ja3_variant_count": 1, "ja3_variants": [ "e67dee91595be601a988d65c46ef4ec7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_3eb18aeec323", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "3eb18aeec323", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-16-43-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788442025, "last_seen": 1788442025, "transport": "t", "ja3_hash": "48c5dcb84b561b11a197afe146166153", "ja3_variant_count": 1, "ja3_variants": [ "48c5dcb84b561b11a197afe146166153" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_78fbab140894", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "78fbab140894", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-5-16-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789923855, "last_seen": 1789923855, "transport": "t", "ja3_hash": "0c360d55bfb45b8c93a83e4c436783c6", "ja3_variant_count": 1, "ja3_variants": [ "0c360d55bfb45b8c93a83e4c436783c6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_a940fb8f7c10", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "a940fb8f7c10", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-45-16-65281-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789531341, "last_seen": 1789531341, "transport": "t", "ja3_hash": "602a90470917345d7fe0d1853284268c", "ja3_variant_count": 1, "ja3_variants": [ "602a90470917345d7fe0d1853284268c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_b1d72b4b9139", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "b1d72b4b9139", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-16-51-43-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788912490, "last_seen": 1788912490, "transport": "t", "ja3_hash": "72b9f553b095353738213ebb911c71c8", "ja3_variant_count": 1, "ja3_variants": [ "72b9f553b095353738213ebb911c71c8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_b3a5ef3b7ae2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "b3a5ef3b7ae2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-35-45-16-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789214376, "last_seen": 1789214376, "transport": "t", "ja3_hash": "ce9a82c8badcb70cfa3e1134676fab74", "ja3_variant_count": 1, "ja3_variants": [ "ce9a82c8badcb70cfa3e1134676fab74" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_dc0fbbb9e544", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "dc0fbbb9e544", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-23-43-51-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789366311, "last_seen": 1789366311, "transport": "t", "ja3_hash": "5297600f5bc62b52f486d81d0992cc3a", "ja3_variant_count": 1, "ja3_variants": [ "5297600f5bc62b52f486d81d0992cc3a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_0b03179d0d9f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "0b03179d0d9f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-23-45-43-16-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788508492, "last_seen": 1788508492, "transport": "t", "ja3_hash": "642cc771717143e402967dfc757d88fc", "ja3_variant_count": 1, "ja3_variants": [ "642cc771717143e402967dfc757d88fc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_0bcd6d2af923", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "0bcd6d2af923", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-16-27-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788535354, "last_seen": 1788535354, "transport": "t", "ja3_hash": "0a6ed87f0fc1798fba7aadc2ec645de3", "ja3_variant_count": 1, "ja3_variants": [ "0a6ed87f0fc1798fba7aadc2ec645de3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_1dadfcf2f95b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "1dadfcf2f95b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-11-13-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789118383, "last_seen": 1789118383, "transport": "t", "ja3_hash": "387527a5dd28baa65467acf5b6707fd3", "ja3_variant_count": 1, "ja3_variants": [ "387527a5dd28baa65467acf5b6707fd3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_346cdd067199", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "346cdd067199", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-65281-13-43-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027385, "last_seen": 1789027385, "transport": "t", "ja3_hash": "076c3506d857690f9860de4be5792f1a", "ja3_variant_count": 1, "ja3_variants": [ "076c3506d857690f9860de4be5792f1a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_3e36865328f2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "3e36865328f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51764-13-16-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015033, "last_seen": 1789015033, "transport": "t", "ja3_hash": "d3509b4d74274b2422c3bdf855e6cef3", "ja3_variant_count": 1, "ja3_variants": [ "d3509b4d74274b2422c3bdf855e6cef3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_3ff929da8650", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "3ff929da8650", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-51-5-17613-43-27-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789740305, "last_seen": 1789740305, "transport": "t", "ja3_hash": "129ea1c18f853d45a748fb31128d83dc", "ja3_variant_count": 1, "ja3_variants": [ "129ea1c18f853d45a748fb31128d83dc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_5a129f0e4836", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "5a129f0e4836", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-16-17613-23-5-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788932416, "last_seen": 1788932416, "transport": "t", "ja3_hash": "819b52a62eca5b6b19c3e70652bfe8b8", "ja3_variant_count": 1, "ja3_variants": [ "819b52a62eca5b6b19c3e70652bfe8b8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_62f180a26051", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "62f180a26051", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-43-65037-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789744531, "last_seen": 1789744531, "transport": "t", "ja3_hash": "e13190080c7ef5454e5ffd8678d64877", "ja3_variant_count": 1, "ja3_variants": [ "e13190080c7ef5454e5ffd8678d64877" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_fc7e7bf80214", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "fc7e7bf80214", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-13-65037-16-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789626392, "last_seen": 1789626392, "transport": "t", "ja3_hash": "1aa7646f0f8f05bfac7340967f3e9cb6", "ja3_variant_count": 1, "ja3_variants": [ "1aa7646f0f8f05bfac7340967f3e9cb6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507ht_8daaf6152771_8ac5942d1fe6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507ht", "b": "8daaf6152771", "c": "8ac5942d1fe6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-18-43-13-51-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789623643, "last_seen": 1789623643, "transport": "t", "ja3_hash": "08efc42d5c175cfc1ff4324fde01ff2a", "ja3_variant_count": 1, "ja3_variants": [ "08efc42d5c175cfc1ff4324fde01ff2a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507ht_8daaf6152771_aa3157764e49", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507ht", "b": "8daaf6152771", "c": "aa3157764e49", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-16-5-11-45-10,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788888901, "last_seen": 1788888901, "transport": "t", "ja3_hash": "6866278b7c8a844ced8e68c1df0c848a", "ja3_variant_count": 1, "ja3_variants": [ "6866278b7c8a844ced8e68c1df0c848a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_2fe69b12b5ab", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "2fe69b12b5ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-16-17613-13-43-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788533142, "last_seen": 1788533142, "transport": "t", "ja3_hash": "ab59bd58206d0d03d4802879ceb0496c", "ja3_variant_count": 1, "ja3_variants": [ "ab59bd58206d0d03d4802879ceb0496c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_4c9ab3d858df", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "4c9ab3d858df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-43-5-16-51-11-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788866491, "last_seen": 1788866491, "transport": "t", "ja3_hash": "85258a92336aadfd40d279557ccf117b", "ja3_variant_count": 1, "ja3_variants": [ "85258a92336aadfd40d279557ccf117b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_4e8e7a8eabd3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "4e8e7a8eabd3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-65037-5-43-17613-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788520305, "last_seen": 1788520305, "transport": "t", "ja3_hash": "1cef5044f77ffcc0a82e0f8469ffe46a", "ja3_variant_count": 1, "ja3_variants": [ "1cef5044f77ffcc0a82e0f8469ffe46a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_9c3383f116e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "9c3383f116e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-18-23-51764-43-11-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789850395, "last_seen": 1789850395, "transport": "t", "ja3_hash": "1dae795bd484a02d92596c630d2fb62b", "ja3_variant_count": 1, "ja3_variants": [ "1dae795bd484a02d92596c630d2fb62b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_9e41d4bd8d69", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "9e41d4bd8d69", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,43-16-13-10-18-65281-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789719560, "last_seen": 1789719560, "transport": "t", "ja3_hash": "9baa6de9a8bb68f8eba784ef9beab425", "ja3_variant_count": 1, "ja3_variants": [ "9baa6de9a8bb68f8eba784ef9beab425" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_ca78c6148bda", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "ca78c6148bda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-43-45-16-27-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788535356, "last_seen": 1788535356, "transport": "t", "ja3_hash": "aafd5001143fef996c126abc9bae546b", "ja3_variant_count": 1, "ja3_variants": [ "aafd5001143fef996c126abc9bae546b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_1fed6ac615b3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "1fed6ac615b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-45-23-43-51764-18-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789587737, "last_seen": 1789587737, "transport": "t", "ja3_hash": "f1c4d80c119e6d0e4bb4803337a386cf", "ja3_variant_count": 1, "ja3_variants": [ "f1c4d80c119e6d0e4bb4803337a386cf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_2c39d0c819dc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "2c39d0c819dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-18-11-10-16-35-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789906992, "last_seen": 1789906992, "transport": "t", "ja3_hash": "0138a4f102a97581f71bb3f8dbdb846b", "ja3_variant_count": 1, "ja3_variants": [ "0138a4f102a97581f71bb3f8dbdb846b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_30e02203ccdb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "30e02203ccdb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-27-17613-10-16-65281-18-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789678219, "last_seen": 1789678219, "transport": "t", "ja3_hash": "b25f85b2ba32ca0efe3204841be5d5a1", "ja3_variant_count": 1, "ja3_variants": [ "b25f85b2ba32ca0efe3204841be5d5a1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_84f0b90a4ef6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "84f0b90a4ef6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,43-10-13-65037-65281-45-16-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789841721, "last_seen": 1789841721, "transport": "t", "ja3_hash": "803d794c71651a3955e2fa708116b1ad", "ja3_variant_count": 1, "ja3_variants": [ "803d794c71651a3955e2fa708116b1ad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_8e9fa813db07", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "8e9fa813db07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,11-18-16-43-35-5-51764-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788887854, "last_seen": 1788887854, "transport": "t", "ja3_hash": "5f7346810da9cfaa088b2d98973d4185", "ja3_variant_count": 1, "ja3_variants": [ "5f7346810da9cfaa088b2d98973d4185" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_91786f7c983b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "91786f7c983b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-16-5-10-35-43-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391198, "last_seen": 1789391198, "transport": "t", "ja3_hash": "21216ba986604b3a73e3771cea5f312b", "ja3_variant_count": 1, "ja3_variants": [ "21216ba986604b3a73e3771cea5f312b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_9988eb27965e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "9988eb27965e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-23-27-45-16-43-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789782412, "last_seen": 1789782412, "transport": "t", "ja3_hash": "1b9371e9361ea393bf34f12a5fda1a0b", "ja3_variant_count": 1, "ja3_variants": [ "1b9371e9361ea393bf34f12a5fda1a0b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_9b4003f4233b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "9b4003f4233b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-65037-16-45-10-35-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788444968, "last_seen": 1788444968, "transport": "t", "ja3_hash": "6f2088423684447b6d62a4ba84a88d36", "ja3_variant_count": 1, "ja3_variants": [ "6f2088423684447b6d62a4ba84a88d36" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_aa69ecebf247", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "aa69ecebf247", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-5-13-23-18-51764-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789820713, "last_seen": 1789820713, "transport": "t", "ja3_hash": "9ad86f2d7881941b91260f33e7d1118e", "ja3_variant_count": 1, "ja3_variants": [ "9ad86f2d7881941b91260f33e7d1118e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_c929afe22e0e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "c929afe22e0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-65281-16-43-10-45-27-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391200, "last_seen": 1789391200, "transport": "t", "ja3_hash": "da6b37c7108322f0ecc97d4c42544185", "ja3_variant_count": 1, "ja3_variants": [ "da6b37c7108322f0ecc97d4c42544185" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_e4e445fafda0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "e4e445fafda0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-43-18-45-11-51-16-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789516985, "last_seen": 1789516985, "transport": "t", "ja3_hash": "bba9d916c080c1019f2cc818d4a5f57d", "ja3_variant_count": 1, "ja3_variants": [ "bba9d916c080c1019f2cc818d4a5f57d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_f2e24db3e0dc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "f2e24db3e0dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-5-51764-43-65281-10-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789775631, "last_seen": 1789775631, "transport": "t", "ja3_hash": "291e9476e27eaa5e7c5513a20867edf6", "ja3_variant_count": 1, "ja3_variants": [ "291e9476e27eaa5e7c5513a20867edf6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_fdf6e4dfc96f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "fdf6e4dfc96f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-16-35-11-10-5-51-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788774306, "last_seen": 1788774306, "transport": "t", "ja3_hash": "ff69dea1f38243785fe7c32eafd6b466", "ja3_variant_count": 1, "ja3_variants": [ "ff69dea1f38243785fe7c32eafd6b466" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_fe5de01693b5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "fe5de01693b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-10-16-27-35-65281-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789418207, "last_seen": 1789418207, "transport": "t", "ja3_hash": "4a13229abfb1df710624a5a2d548c112", "ja3_variant_count": 1, "ja3_variants": [ "4a13229abfb1df710624a5a2d548c112" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_044a1a682098", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "044a1a682098", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-65037-5-23-43-27-65281-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789306597, "last_seen": 1789306597, "transport": "t", "ja3_hash": "d0af70a570259c1b6f7f567d6dbdd107", "ja3_variant_count": 1, "ja3_variants": [ "d0af70a570259c1b6f7f567d6dbdd107" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_10412b81caa9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "10412b81caa9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-17613-35-51-16-65281-5-18-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788967866, "last_seen": 1788967866, "transport": "t", "ja3_hash": "8b3c626e544e81afaee5ed492a6080c7", "ja3_variant_count": 1, "ja3_variants": [ "8b3c626e544e81afaee5ed492a6080c7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_1830e330277b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "1830e330277b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-13-27-43-17613-65281-16-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789702111, "last_seen": 1789702111, "transport": "t", "ja3_hash": "d468cf8d1f9448f45e3993d4be799232", "ja3_variant_count": 1, "ja3_variants": [ "d468cf8d1f9448f45e3993d4be799232" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_1f67a48d0638", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "1f67a48d0638", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-10-43-65037-35-23-18-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788931414, "last_seen": 1788931414, "transport": "t", "ja3_hash": "6e3f830b89d8e5d909581ec90b6f0b23", "ja3_variant_count": 1, "ja3_variants": [ "6e3f830b89d8e5d909581ec90b6f0b23" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_31254715ad9d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "31254715ad9d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-23-16-5-17613-10-65281-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789460111, "last_seen": 1789460111, "transport": "t", "ja3_hash": "164f79b7b985af09dac4df7656ccb470", "ja3_variant_count": 1, "ja3_variants": [ "164f79b7b985af09dac4df7656ccb470" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_3823b72ec821", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "3823b72ec821", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-5-35-51764-10-43-45-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789923855, "last_seen": 1789923855, "transport": "t", "ja3_hash": "00e6aad09092c2302307d7b770b4620b", "ja3_variant_count": 1, "ja3_variants": [ "00e6aad09092c2302307d7b770b4620b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_3860589775e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "3860589775e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-5-17613-45-16-43-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730580, "last_seen": 1789730580, "transport": "t", "ja3_hash": "315cdd7c82e3017f20ff6963c7fa04db", "ja3_variant_count": 1, "ja3_variants": [ "315cdd7c82e3017f20ff6963c7fa04db" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_4ea40d3583fa", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "4ea40d3583fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-27-43-11-45-18-13-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789430934, "last_seen": 1789430934, "transport": "t", "ja3_hash": "64ab79d368544a38013ba408488cafc8", "ja3_variant_count": 1, "ja3_variants": [ "64ab79d368544a38013ba408488cafc8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_60714cf682f4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "60714cf682f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-11-18-23-43-35-16-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788454619, "last_seen": 1788454619, "transport": "t", "ja3_hash": "959e11d4df5a0e55757a1f9d4814b07d", "ja3_variant_count": 1, "ja3_variants": [ "959e11d4df5a0e55757a1f9d4814b07d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_91860ce74887", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "91860ce74887", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-16-43-45-11-5-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789402740, "last_seen": 1789402740, "transport": "t", "ja3_hash": "a90c5676e924a5b263cfe07e056a0f08", "ja3_variant_count": 1, "ja3_variants": [ "a90c5676e924a5b263cfe07e056a0f08" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_9441bb5508b5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "9441bb5508b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-13-35-11-45-43-65037-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789366309, "last_seen": 1789366309, "transport": "t", "ja3_hash": "e62cce2563d8b2a4baf3b79777d1addc", "ja3_variant_count": 1, "ja3_variants": [ "e62cce2563d8b2a4baf3b79777d1addc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_98cc64a37b71", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "98cc64a37b71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-65037-10-5-45-13-23-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789889717, "last_seen": 1789889717, "transport": "t", "ja3_hash": "a3dcac40650a405c9432f98ce4a9bc62", "ja3_variant_count": 1, "ja3_variants": [ "a3dcac40650a405c9432f98ce4a9bc62" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_a6e04712e4be", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "a6e04712e4be", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-65037-16-11-18-35-13-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788442228, "last_seen": 1788442228, "transport": "t", "ja3_hash": "efab5e284344d4e4160e62a326003bb2", "ja3_variant_count": 1, "ja3_variants": [ "efab5e284344d4e4160e62a326003bb2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_b324f17a43e3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "b324f17a43e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-35-65037-51764-45-43-27-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789697089, "last_seen": 1789697089, "transport": "t", "ja3_hash": "3a184029f17a0685cf6b33004efd3871", "ja3_variant_count": 1, "ja3_variants": [ "3a184029f17a0685cf6b33004efd3871" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_be4270e92056", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "be4270e92056", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-65037-43-27-35-10-13-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789704614, "last_seen": 1789704614, "transport": "t", "ja3_hash": "21c8affeeec99229a1631e62a19c6d36", "ja3_variant_count": 1, "ja3_variants": [ "21c8affeeec99229a1631e62a19c6d36" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_f957e4343dc4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "f957e4343dc4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-43-11-51764-35-17613-10-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788714110, "last_seen": 1788714110, "transport": "t", "ja3_hash": "bd880e83810750ac9abf7a5500249bd6", "ja3_variant_count": 1, "ja3_variants": [ "bd880e83810750ac9abf7a5500249bd6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_52cded8f1e0e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "52cded8f1e0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-10-18-13-5-43-45-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789214145, "last_seen": 1789214145, "transport": "t", "ja3_hash": "c5c8cf995bd0aad0d0d18e6455a218e7", "ja3_variant_count": 1, "ja3_variants": [ "c5c8cf995bd0aad0d0d18e6455a218e7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_7409daeab43f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "7409daeab43f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-13-23-45-10-16-65037-27-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789490180, "last_seen": 1789490180, "transport": "t", "ja3_hash": "27cd66dface84592a881b793605731f1", "ja3_variant_count": 1, "ja3_variants": [ "27cd66dface84592a881b793605731f1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_a036f2ddd51c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "a036f2ddd51c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-5-51764-10-11-27-16-17613-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789641713, "last_seen": 1789641713, "transport": "t", "ja3_hash": "21864fefa4e4c339c582ad7e62f78657", "ja3_variant_count": 1, "ja3_variants": [ "21864fefa4e4c339c582ad7e62f78657" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_bd168f6167c5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "bd168f6167c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-13-18-43-23-11-35-10-17513-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788777053, "last_seen": 1788777053, "transport": "t", "ja3_hash": "c0c7a9f2be05af81f6e79dac349c4acb", "ja3_variant_count": 1, "ja3_variants": [ "c0c7a9f2be05af81f6e79dac349c4acb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_d3c6ff16a764", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "d3c6ff16a764", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-65281-16-45-27-51-18-5-35-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788774107, "last_seen": 1788774107, "transport": "t", "ja3_hash": "64c847b1dd43989de05b6e354e7e77d0", "ja3_variant_count": 1, "ja3_variants": [ "64c847b1dd43989de05b6e354e7e77d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_dae2e08b9725", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "dae2e08b9725", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-23-35-18-16-17613-10-45-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789436557, "last_seen": 1789436557, "transport": "t", "ja3_hash": "3eabab3bdb62efd56e58e34c17a37f5d", "ja3_variant_count": 1, "ja3_variants": [ "3eabab3bdb62efd56e58e34c17a37f5d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_dbfa395aa8b8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "dbfa395aa8b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-16-35-43-65037-10-65281-23-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789511122, "last_seen": 1789511122, "transport": "t", "ja3_hash": "da73d2a582b9824523953cc9a75132f8", "ja3_variant_count": 1, "ja3_variants": [ "da73d2a582b9824523953cc9a75132f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_dc896c8e5b7d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "dc896c8e5b7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-45-65037-35-5-51764-43-13-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789478748, "last_seen": 1789478748, "transport": "t", "ja3_hash": "4386efc8ca49b63ea8ee08a666afbaf0", "ja3_variant_count": 1, "ja3_variants": [ "4386efc8ca49b63ea8ee08a666afbaf0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_e3fa93bc5222", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "e3fa93bc5222", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-16-65281-18-13-11-27-17613-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789957553, "last_seen": 1789957553, "transport": "t", "ja3_hash": "49a89e548440f260edcf30afbbd6a0f5", "ja3_variant_count": 1, "ja3_variants": [ "49a89e548440f260edcf30afbbd6a0f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_f6906f6a6679", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "f6906f6a6679", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-18-27-5-45-16-43-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789657008, "last_seen": 1789657008, "transport": "t", "ja3_hash": "91f8d071abe2678b7c50d8d2fcff2a5d", "ja3_variant_count": 1, "ja3_variants": [ "91f8d071abe2678b7c50d8d2fcff2a5d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_64e188f86a8a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "64e188f86a8a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-16-13-65281-11-5-43-27-23-17513-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789305071, "last_seen": 1789305071, "transport": "t", "ja3_hash": "92e89c334b057782f84fba56dc61de58", "ja3_variant_count": 1, "ja3_variants": [ "92e89c334b057782f84fba56dc61de58" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_6839f114548f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "6839f114548f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-23-11-13-51764-16-35-43-5-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789355788, "last_seen": 1789355788, "transport": "t", "ja3_hash": "e3e3ad652d6d0d9db1aadc9ca8767bd1", "ja3_variant_count": 1, "ja3_variants": [ "e3e3ad652d6d0d9db1aadc9ca8767bd1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_68811b12ddc9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "68811b12ddc9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-13-16-43-27-65281-45-51764-65037-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789423585, "last_seen": 1789423585, "transport": "t", "ja3_hash": "eaba366a010035f2a71a11fa192aa3c3", "ja3_variant_count": 1, "ja3_variants": [ "eaba366a010035f2a71a11fa192aa3c3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_005eabb71a4e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "005eabb71a4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-45-5-13-18-43-11-10-35-65037-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789200139, "last_seen": 1789200139, "transport": "t", "ja3_hash": "b21a2d83aaeb7a1c1d85faad50965206", "ja3_variant_count": 1, "ja3_variants": [ "b21a2d83aaeb7a1c1d85faad50965206" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_3b1d558f143e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "3b1d558f143e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-65281-27-35-16-43-18-65037-13-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788777963, "last_seen": 1788777963, "transport": "t", "ja3_hash": "85b6b91ebfa82c73167da76be0f26520", "ja3_variant_count": 1, "ja3_variants": [ "85b6b91ebfa82c73167da76be0f26520" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_52c029195883", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "52c029195883", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-16-51764-65281-35-43-13-45-5-18-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789469869, "last_seen": 1789469869, "transport": "t", "ja3_hash": "6efe673477968010395aa98444d8f9b5", "ja3_variant_count": 1, "ja3_variants": [ "6efe673477968010395aa98444d8f9b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_7730a271a43a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "7730a271a43a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-16-65037-43-23-45-51764-13-65281-27-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789490312, "last_seen": 1789490312, "transport": "t", "ja3_hash": "7d2c7d6497d4aaebb029f2e0fe57c821", "ja3_variant_count": 1, "ja3_variants": [ "7d2c7d6497d4aaebb029f2e0fe57c821" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_7f2037aa1c7d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "7f2037aa1c7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-45-51764-43-23-10-18-65281-35-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788499358, "last_seen": 1788499358, "transport": "t", "ja3_hash": "a93c20ff63c930339ce4fefa9b9b0083", "ja3_variant_count": 1, "ja3_variants": [ "a93c20ff63c930339ce4fefa9b9b0083" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_9a47ed8bf678", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "9a47ed8bf678", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-16-11-23-27-35-18-10-17613-13-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788867389, "last_seen": 1788867389, "transport": "t", "ja3_hash": "963232d9269c83fb61bfd6f81ea27d8b", "ja3_variant_count": 1, "ja3_variants": [ "963232d9269c83fb61bfd6f81ea27d8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_a47b94ab433f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "a47b94ab433f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-10-27-43-45-51764-23-17613-18-65281-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788461784, "last_seen": 1788461784, "transport": "t", "ja3_hash": "27ee73bb478ecea0c2634edfeb56ff26", "ja3_variant_count": 1, "ja3_variants": [ "27ee73bb478ecea0c2634edfeb56ff26" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_b81965684095", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "b81965684095", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-43-45-11-10-65037-23-13-65281-17613-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789630816, "last_seen": 1789630816, "transport": "t", "ja3_hash": "0fe4b3d581453b77c6e2dfbe0d2da802", "ja3_variant_count": 1, "ja3_variants": [ "0fe4b3d581453b77c6e2dfbe0d2da802" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_4ab3e390d7e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "4ab3e390d7e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-35-5-27-45-13-16-23-43-11-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789567940, "last_seen": 1789567940, "transport": "t", "ja3_hash": "6256b236be793ef7b7f7353ec03217fe", "ja3_variant_count": 1, "ja3_variants": [ "6256b236be793ef7b7f7353ec03217fe" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_56a286331089", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "56a286331089", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-35-18-13-23-11-5-45-65037-27-17613-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789273193, "last_seen": 1789273193, "transport": "t", "ja3_hash": "eb5f343d38b8e99da499ada98bca3c97", "ja3_variant_count": 1, "ja3_variants": [ "eb5f343d38b8e99da499ada98bca3c97" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_9c397acbd780", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "9c397acbd780", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-18-27-13-10-17613-43-16-23-45-11-65037-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788931109, "last_seen": 1788931109, "transport": "t", "ja3_hash": "423bf08eb490c579ab82c6ddeaa8e5ec", "ja3_variant_count": 1, "ja3_variants": [ "423bf08eb490c579ab82c6ddeaa8e5ec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_b9c352a595c8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "b9c352a595c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-10-27-23-5-16-11-35-51764-65037-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789671196, "last_seen": 1789671196, "transport": "t", "ja3_hash": "a6e2236c397d1768ffba6a395b09a796", "ja3_variant_count": 1, "ja3_variants": [ "a6e2236c397d1768ffba6a395b09a796" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_cd4096077622", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "cd4096077622", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-45-43-27-51764-13-35-10-16-18-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789499995, "last_seen": 1789499995, "transport": "t", "ja3_hash": "7a9bad7cff5c65351dfcbaa4441cac5a", "ja3_variant_count": 1, "ja3_variants": [ "7a9bad7cff5c65351dfcbaa4441cac5a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_cf6e1259dba2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "cf6e1259dba2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-65037-10-16-43-45-17613-5-65281-23-13-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788776667, "last_seen": 1788776667, "transport": "t", "ja3_hash": "85c9dde6eafd68f4e4a0e3aba79e8326", "ja3_variant_count": 1, "ja3_variants": [ "85c9dde6eafd68f4e4a0e3aba79e8326" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_f27a46184afd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "f27a46184afd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-13-45-23-11-65037-65281-10-17613-27-5-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789681707, "last_seen": 1789681707, "transport": "t", "ja3_hash": "16ec5ba4aac6ab1bd459f1dfe962cce9", "ja3_variant_count": 1, "ja3_variants": [ "16ec5ba4aac6ab1bd459f1dfe962cce9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_55449e25bcac", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "55449e25bcac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-65037-51764-10-13-23-45-11-17613-18-27-65281-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789907468, "last_seen": 1789907468, "transport": "t", "ja3_hash": "ab9b94f67dead44454a41b5859308a64", "ja3_variant_count": 1, "ja3_variants": [ "ab9b94f67dead44454a41b5859308a64" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_ec7d4e755158", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "ec7d4e755158", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-10-5-11-16-65281-18-35-65037-17613-43-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789149828, "last_seen": 1789149828, "transport": "t", "ja3_hash": "d6d14146b306e445654dc47f605b73ef", "ja3_variant_count": 1, "ja3_variants": [ "d6d14146b306e445654dc47f605b73ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_f5728d627f6c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "f5728d627f6c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-65281-23-65037-27-45-10-18-43-16-13-51764-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789461361, "last_seen": 1789461361, "transport": "t", "ja3_hash": "3b02b462b23478ab91694d7b2f6645de", "ja3_variant_count": 1, "ja3_variants": [ "3b02b462b23478ab91694d7b2f6645de" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1516h2_8daaf6152771_9d0d4a7883f6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1516h2", "b": "8daaf6152771", "c": "9d0d4a7883f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-13-23-27-18-16-45-65037-17613-43-5-65281-35-11-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789336232, "last_seen": 1789336233, "transport": "t", "ja3_hash": "183a825edfa88023c87a29892ff2eaea", "ja3_variant_count": 2, "ja3_variants": [ "183a825edfa88023c87a29892ff2eaea", "54e4b1d2ea495f717704922da7d5d2d3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1516h2_8daaf6152771_e7524cb1b1c7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1516h2", "b": "8daaf6152771", "c": "e7524cb1b1c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-13-23-18-5-27-35-51764-45-16-43-65281-17613-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789196282, "last_seen": 1789196282, "transport": "t", "ja3_hash": "10ccdb888d1fbbca82a17842fb86b426", "ja3_variant_count": 1, "ja3_variants": [ "10ccdb888d1fbbca82a17842fb86b426" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1517h2_8daaf6152771_68e2f8e9952f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1517h2", "b": "8daaf6152771", "c": "68e2f8e9952f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-18-65037-13-4832-43-51764-27-45-17613-16-10-5-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789587734, "last_seen": 1789587734, "transport": "t", "ja3_hash": "1aaa1575e0925751bcab8d9a46ef8517", "ja3_variant_count": 1, "ja3_variants": [ "1aaa1575e0925751bcab8d9a46ef8517" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1711ht_ab0a1bf427ad_cadf229c9d89", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13i1711ht", "b": "ab0a1bf427ad", "c": "cadf229c9d89", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-11-10-35-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789545430, "last_seen": 1789545430, "transport": "t", "ja3_hash": "696ab274b8c77f6b712e1f50142c1460", "ja3_variant_count": 1, "ja3_variants": [ "696ab274b8c77f6b712e1f50142c1460" ], "user_agents": { "uk-nhs-data/0.0 (internal fraud-research)": 1 }, "ua_disagreement": false } }, { "hash": "t13i3111h2_e8f1e7e78f70_14507d565a4b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i3111h2", "b": "e8f1e7e78f70", "c": "14507d565a4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787776134, "last_seen": 1789590632, "transport": "t", "ja3_hash": "3ac15a6759db1d16101922a658d41dcc", "ja3_variant_count": 1, "ja3_variants": [ "3ac15a6759db1d16101922a658d41dcc" ], "user_agents": [], "ua_disagreement": false } } ] }